5e807de88a43edb7b341ed17b4e218f35c3204bf5dc969c131792b0a23e9ddc1

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Size

1.9MB
MD5

88c85713b28206515423821dce1f0a0b
SHA1

3b8372f2cdf9875b21e189634f50661cf4d40a2c
SHA256

e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d
SHA512

26e7cf21280bf49336462cfcf229ea6a8c72c3241c0398e85e9fb3f2fe50d174e3bb1f0215f784767034a4b1ecbe59d61e02bf4541014612bd0e30f67f5a6a07
SSDEEP

24576:0z4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:0OMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2936	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2844	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2628	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	536	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2352	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	840	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3064	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	448	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	2228	schtasks.exe	31
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	2228	schtasks.exe	31

UAC bypass 3 TTPs 30 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2820	powershell.exe
1880	powershell.exe
2116	powershell.exe
2088	powershell.exe
2996	powershell.exe
2348	powershell.exe
2060	powershell.exe
1056	powershell.exe
1672	powershell.exe
1668	powershell.exe
2500	powershell.exe
1508	powershell.exe
1092	powershell.exe
1780	powershell.exe
304	powershell.exe
320	powershell.exe
2848	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe

Executes dropped EXE 9 IoCs

pid	Process
2280	OSPPSVC.exe
2500	OSPPSVC.exe
2436	OSPPSVC.exe
2260	OSPPSVC.exe
348	OSPPSVC.exe
912	OSPPSVC.exe
1532	OSPPSVC.exe
952	OSPPSVC.exe
2340	OSPPSVC.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	OSPPSVC.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\RCX1FDC.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\services.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\101b941d020240	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\RCX1D4B.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\lsm.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Program Files\Internet Explorer\ja-JP\services.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\RCX18C5.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\RCX18C6.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\lsm.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\es-ES\RCX1DB9.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Program Files\Internet Explorer\ja-JP\RCX1FDD.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\0a1fd5f707cd16	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Program Files\Internet Explorer\ja-JP\c5b4cb5e9653cc	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\system\0a1fd5f707cd16	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\Cursors\RCX23F6.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\TAPI\services.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\system\sppsvc.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\system\RCXE40.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\Vss\Writers\System\OSPPSVC.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\Vss\Writers\System\1610b97d3ab4a7	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\debug\WIA\b75386f1303e64	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\Logs\DPX\3ac3d097200f4f	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\system\sppsvc.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\debug\WIA\RCX1045.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\Logs\DPX\RCX144E.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\Logs\DPX\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\Logs\DPX\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\Vss\Writers\System\OSPPSVC.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\system\RCXE41.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\debug\WIA\RCX1044.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\Cursors\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\Cursors\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\Cursors\3ac3d097200f4f	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\debug\WIA\taskhost.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\Cursors\RCX2464.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\TAPI\c5b4cb5e9653cc	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\Vss\Writers\System\RCXC3B.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\Vss\Writers\System\RCXC3C.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\Logs\DPX\RCX144F.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\TAPI\RCX832.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\TAPI\services.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File created	C:\Windows\debug\WIA\taskhost.exe	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
File opened for modification	C:\Windows\TAPI\RCX831.tmp	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2352	schtasks.exe
3020	schtasks.exe
2340	schtasks.exe
1548	schtasks.exe
2444	schtasks.exe
1804	schtasks.exe
1092	schtasks.exe
688	schtasks.exe
1376	schtasks.exe
292	schtasks.exe
2140	schtasks.exe
1944	schtasks.exe
2268	schtasks.exe
2948	schtasks.exe
2200	schtasks.exe
2912	schtasks.exe
2704	schtasks.exe
2264	schtasks.exe
804	schtasks.exe
2668	schtasks.exe
1672	schtasks.exe
1496	schtasks.exe
1336	schtasks.exe
1820	schtasks.exe
1536	schtasks.exe
812	schtasks.exe
1612	schtasks.exe
1696	schtasks.exe
1240	schtasks.exe
1576	schtasks.exe
2820	schtasks.exe
2420	schtasks.exe
2936	schtasks.exe
2792	schtasks.exe
2860	schtasks.exe
840	schtasks.exe
696	schtasks.exe
1940	schtasks.exe
3000	schtasks.exe
2844	schtasks.exe
536	schtasks.exe
1596	schtasks.exe
1516	schtasks.exe
2576	schtasks.exe
3064	schtasks.exe
448	schtasks.exe
2972	schtasks.exe
2628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
2500	powershell.exe
2820	powershell.exe
1780	powershell.exe
2848	powershell.exe
2348	powershell.exe
2996	powershell.exe
2088	powershell.exe
1672	powershell.exe
1668	powershell.exe
1508	powershell.exe
2060	powershell.exe
1092	powershell.exe
2116	powershell.exe
1880	powershell.exe
1056	powershell.exe
304	powershell.exe
320	powershell.exe
2280	OSPPSVC.exe
2500	OSPPSVC.exe
2436	OSPPSVC.exe
2260	OSPPSVC.exe
348	OSPPSVC.exe
912	OSPPSVC.exe
1532	OSPPSVC.exe
952	OSPPSVC.exe
2340	OSPPSVC.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	304	powershell.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	2280	OSPPSVC.exe
Token: SeDebugPrivilege	2500	OSPPSVC.exe
Token: SeDebugPrivilege	2436	OSPPSVC.exe
Token: SeDebugPrivilege	2260	OSPPSVC.exe
Token: SeDebugPrivilege	348	OSPPSVC.exe
Token: SeDebugPrivilege	912	OSPPSVC.exe
Token: SeDebugPrivilege	1532	OSPPSVC.exe
Token: SeDebugPrivilege	952	OSPPSVC.exe
Token: SeDebugPrivilege	2340	OSPPSVC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2500	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	81
PID 2312 wrote to memory of 2500	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	81
PID 2312 wrote to memory of 2500	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	81
PID 2312 wrote to memory of 1508	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	82
PID 2312 wrote to memory of 1508	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	82
PID 2312 wrote to memory of 1508	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	82
PID 2312 wrote to memory of 2348	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	84
PID 2312 wrote to memory of 2348	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	84
PID 2312 wrote to memory of 2348	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	84
PID 2312 wrote to memory of 2996	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	85
PID 2312 wrote to memory of 2996	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	85
PID 2312 wrote to memory of 2996	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	85
PID 2312 wrote to memory of 2820	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	86
PID 2312 wrote to memory of 2820	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	86
PID 2312 wrote to memory of 2820	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	86
PID 2312 wrote to memory of 2088	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	87
PID 2312 wrote to memory of 2088	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	87
PID 2312 wrote to memory of 2088	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	87
PID 2312 wrote to memory of 2848	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	89
PID 2312 wrote to memory of 2848	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	89
PID 2312 wrote to memory of 2848	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	89
PID 2312 wrote to memory of 1668	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	91
PID 2312 wrote to memory of 1668	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	91
PID 2312 wrote to memory of 1668	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	91
PID 2312 wrote to memory of 2060	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	95
PID 2312 wrote to memory of 2060	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	95
PID 2312 wrote to memory of 2060	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	95
PID 2312 wrote to memory of 1092	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	96
PID 2312 wrote to memory of 1092	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	96
PID 2312 wrote to memory of 1092	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	96
PID 2312 wrote to memory of 1672	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	97
PID 2312 wrote to memory of 1672	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	97
PID 2312 wrote to memory of 1672	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	97
PID 2312 wrote to memory of 1780	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	98
PID 2312 wrote to memory of 1780	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	98
PID 2312 wrote to memory of 1780	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	98
PID 2312 wrote to memory of 2116	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	100
PID 2312 wrote to memory of 2116	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	100
PID 2312 wrote to memory of 2116	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	100
PID 2312 wrote to memory of 304	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	101
PID 2312 wrote to memory of 304	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	101
PID 2312 wrote to memory of 304	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	101
PID 2312 wrote to memory of 1056	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	103
PID 2312 wrote to memory of 1056	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	103
PID 2312 wrote to memory of 1056	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	103
PID 2312 wrote to memory of 1880	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	104
PID 2312 wrote to memory of 1880	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	104
PID 2312 wrote to memory of 1880	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	104
PID 2312 wrote to memory of 320	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	105
PID 2312 wrote to memory of 320	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	105
PID 2312 wrote to memory of 320	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	105
PID 2312 wrote to memory of 1052	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	115
PID 2312 wrote to memory of 1052	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	115
PID 2312 wrote to memory of 1052	2312	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe	115
PID 1052 wrote to memory of 2164	1052	cmd.exe	117
PID 1052 wrote to memory of 2164	1052	cmd.exe	117
PID 1052 wrote to memory of 2164	1052	cmd.exe	117
PID 1052 wrote to memory of 2280	1052	cmd.exe	118
PID 1052 wrote to memory of 2280	1052	cmd.exe	118
PID 1052 wrote to memory of 2280	1052	cmd.exe	118
PID 2280 wrote to memory of 2704	2280	OSPPSVC.exe	119
PID 2280 wrote to memory of 2704	2280	OSPPSVC.exe	119
PID 2280 wrote to memory of 2704	2280	OSPPSVC.exe	119
PID 2280 wrote to memory of 1036	2280	OSPPSVC.exe	120

System policy modification 1 TTPs 30 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	OSPPSVC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe
"C:\Users\Admin\AppData\Local\Temp\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\TAPI\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Vss\Writers\System\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\system\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\WIA\taskhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Logs\DPX\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\ja-JP\services.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\Sample Videos\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EuziAK6wbh.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2164
- - C:\Windows\Vss\Writers\System\OSPPSVC.exe
    "C:\Windows\Vss\Writers\System\OSPPSVC.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2280
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0cfae547-5d02-407d-983e-7f2541e79043.vbs"
      4⤵
      PID:2704
    - - C:\Windows\Vss\Writers\System\OSPPSVC.exe
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2500
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ae9dfb25-285c-4127-b346-30f595a80a86.vbs"
        6⤵
        
        PID:1448
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        7⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a3720db5-9be6-4378-bdd1-318f29854573.vbs"
        8⤵
        
        PID:2088
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        9⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2260
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a9e00ae7-5606-4637-9407-1f662eafba1d.vbs"
        10⤵
        
        PID:1604
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        11⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:348
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\76dfeb55-d881-4162-9605-39a66b67a6ed.vbs"
        12⤵
        
        PID:1756
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        13⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7c4e580-186c-4206-97c9-1d8ab0e8df89.vbs"
        14⤵
        
        PID:804
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        15⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6bb80e0a-0dd9-482f-85e0-d0bef6a2a025.vbs"
        16⤵
        
        PID:3012
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        17⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\83260927-cbee-4814-9c38-3525863bc52a.vbs"
        18⤵
        
        PID:1892
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        
        C:\Windows\Vss\Writers\System\OSPPSVC.exe
        19⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2340
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\39d2a455-370e-473f-819b-17d521cc1674.vbs"
        18⤵
        
        PID:1668
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\29d76a1d-d0ea-4286-881a-87bbee0d2445.vbs"
        16⤵
        
        PID:1980
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\df8fe782-37bd-4a6f-a802-8c4d8b8be047.vbs"
        14⤵
        
        PID:2084
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\60ca852a-4505-4d48-a7b7-948ef6109a77.vbs"
        12⤵
        
        PID:2392
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\14684635-a785-4195-93b4-59e532da97b7.vbs"
        10⤵
        
        PID:1272
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c90d1849-5a65-472d-9037-365012adbfb1.vbs"
        8⤵
        
        PID:1588
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c117cff3-074f-4818-bc67-d324708476f8.vbs"
        6⤵
        
        PID:2368
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\21d05a5f-ceed-4ca5-9588-77cc6b23fe51.vbs"
      4⤵
      PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 8 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\TAPI\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\TAPI\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 10 /tr "'C:\Windows\TAPI\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Windows\Vss\Writers\System\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\System\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Windows\Vss\Writers\System\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Windows\system\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\system\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\system\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Windows\debug\WIA\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\debug\WIA\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 7 /tr "'C:\Windows\debug\WIA\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\f6a14ac2-8725-11ef-a9ab-dab21757c799\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0de" /sc MINUTE /mo 8 /tr "'C:\Windows\Logs\DPX\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d" /sc ONLOGON /tr "'C:\Windows\Logs\DPX\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0de" /sc MINUTE /mo 12 /tr "'C:\Windows\Logs\DPX\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Desktop\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Desktop\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Desktop\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\ja-JP\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\ja-JP\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Videos\Sample Videos\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Videos\Sample Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\Sample Videos\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0de" /sc MINUTE /mo 12 /tr "'C:\Windows\Cursors\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d" /sc ONLOGON /tr "'C:\Windows\Cursors\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0de" /sc MINUTE /mo 14 /tr "'C:\Windows\Cursors\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows NT\TableTextService\es-ES\lsm.exe

Filesize
1.9MB

MD5
b2be528b2e9b78f89f23cadd5b85bf72

SHA1
6eed172a6117361cfe98bb10f132268a1449d6c0

SHA256
3485f61cfa5d377b239318e47e78c0e327979bc899158e3b78a12321e295679c

SHA512
6986fdb133cbbba922a912e508f94c94ef4453702232b135476b85cbdb22b5ef8213b3f5ac336579be2ffac577bd0549637a835a81eb7b14267fa13cf1e2ad3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\0cfae547-5d02-407d-983e-7f2541e79043.vbs

Filesize
717B

MD5
3057ef978b41d5a70905fce365d67215

SHA1
0bf3a70f3e23bb2ca7f6ee84162c744057d29056

SHA256
9e4435aed134daf26593abd05017fe04dd071e4bcd7c2e7349f34c7dcceb2101

SHA512
d3c10ce9aeb2f802cae6a7028613b1af2e901080bba8a7ec8a07e27dde04498dbeca0c734d541b68856cd440a042c0d6f0f5c6cdad8392ed2c1afaba96299d54

Download Submit
C:\Users\Admin\AppData\Local\Temp\21d05a5f-ceed-4ca5-9588-77cc6b23fe51.vbs

Filesize
493B

MD5
151f454fbd5be9ee574fceb881fe0236

SHA1
08649262e43ac495abf90819a807407b6aedc89c

SHA256
1b59236a7a3cbeec8e0bcdc262afb281570ac4c73c14892f934a48bc479b8ce6

SHA512
726fc5f18f58861a4562ded57ab2a3c337b53f9f863f8be19e9028921fcc4fd4a1ace824b96ecf221367c0d0cbcc292021abe8692e6846d8a4336b926b698c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\6bb80e0a-0dd9-482f-85e0-d0bef6a2a025.vbs

Filesize
717B

MD5
048f7a374c12fb79ff2e114d773aca92

SHA1
d41587dc8de21760e7c6a831a9367a2559513932

SHA256
6ab75c158514d5fc4f931f9835d362ec5ec175c6e1055c00514e5500d57153fe

SHA512
26747696dffa3e07f1c04ddc977f54ae7cbe22b564f4d236b8671265805c7abd44925f3562add3f8dcf63a49ce278dfe31f10b8397bdfce0db1abcd2a9b14767

Download Submit
C:\Users\Admin\AppData\Local\Temp\76dfeb55-d881-4162-9605-39a66b67a6ed.vbs

Filesize
716B

MD5
bbb51b224026eee3c79a84f25c8ad81a

SHA1
5a076a3a6e4ab1f692890655e1ed0d998a3a675c

SHA256
7fe4ee22b58d0967202b8dee6246d8ec9884c2e5e35822ed1d48791c9d8094eb

SHA512
c8b00ec341aeae55098e79be287dd6f553179c559eb811e45a5c1588636614348e2511af6e9f6b6ea3a98a921194107731b2adb1546e509730fa05baa800b76c

Download Submit
C:\Users\Admin\AppData\Local\Temp\83260927-cbee-4814-9c38-3525863bc52a.vbs

Filesize
716B

MD5
57427fe415658816fb13dbc45e899655

SHA1
01c999461b00aa1d044a273ccbdaa4adcbcdbea0

SHA256
e15d7a143a058df5176387b82eb99ac928c35b37bd6b3bcf7e8c2ab958a41615

SHA512
324c8516ced56571bfee9bc5613a6b0368769ddf0b539147f7581ee79ea41162d9fcece136070c6b076cad0770b6ab31328ee962ff760e7164bffd4b5aeb28cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\EuziAK6wbh.bat

Filesize
206B

MD5
05ea056df9a25c5d60e29066c9f2ab2d

SHA1
bec66b3681a3bace86c60d776e8eb4964e4ef14c

SHA256
139e76a9dfe3d7aeb5cc12ee43e7456578fd289999712c9face772f2d0e70e30

SHA512
be369855b86b9a4eedd3a6e7afb2d93f6610305cc9520bb2ef8f1f027625977416a3750f8bb2bfaeb46eb34c86a1fde0900510c5622e139456fcfe452a84d890

Download Submit
C:\Users\Admin\AppData\Local\Temp\a3720db5-9be6-4378-bdd1-318f29854573.vbs

Filesize
717B

MD5
224e2701062491e6de9724c9057633e2

SHA1
4e3f8f05391e268aff4fe584fcf0fb745e88cd2f

SHA256
13fde2202b5f620fc759ec5b86050cc02aaff504dc6a46ef10d4535cef704adf

SHA512
1e6dd211e0378ab088d0e784d53959244455ecea297cc04a7852039d5cef6959c664ee53c3cc677b74a210adcc4c0aae6d4f1af79543a51598cd61a317b33cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\a9e00ae7-5606-4637-9407-1f662eafba1d.vbs

Filesize
717B

MD5
4c187a1a37eccb3390bc7e8ef02fa358

SHA1
6d51e183a91ea201869d1fe7e437d6fa4bd90e57

SHA256
5f18651f27d20df4a17e8cea5bf445c461777b0d486aea27c7949f143b093d9e

SHA512
d35ec1d65f447fc23f0df73fdc20d06999e8be561f35ebbb910d08dafc372cd1939144fa99264f2b3ef621ab9df483248b9d1ecaaec35b79894a267413c1037c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ae9dfb25-285c-4127-b346-30f595a80a86.vbs

Filesize
717B

MD5
f0ed30b940ad0d603edf0c767d46c5e8

SHA1
2adf3eda2c608b5abe332f9827d8ee2b0807f275

SHA256
ef62026dcafaa319768aebc7f2f3e1f61ea948fca0b650530d1409e3b43d4aae

SHA512
5ffc475b2dec6effabe62660f1d3aec09b02902d23bd3a5c85b0f991ebd0449d32eea9b8b907e2f90ab0e5ebd65d8062ba0a8b08d6ce1d5b3806d3a96b309d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\d7c4e580-186c-4206-97c9-1d8ab0e8df89.vbs

Filesize
716B

MD5
298a4a5c0192bf0561f572c40b2dd124

SHA1
ebe51dd9d065408ee7b95f06bc2a70e1795083f9

SHA256
02263f3f42fdf9448be20633e600c2e97f0c2e0eb97f4007e7e2d53af3428a58

SHA512
68d47b2419314f3996998dc13de858fccd4e11c2652d0765a670ed1af5802df682b419ba818c78aa7aa9d63715cb8e5a766d453365011eea3cdfa6a1123c7bc2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
9facc535a14ebc30537c772a8fe6bd1c

SHA1
91858372077b4ffb95bddb8ed0b61dbefd11cee0

SHA256
fcbc72d25b7b2cf932e858a4bc43db8f073f290d2e4abb2525fbcdec9fe6a8f4

SHA512
6733c236b113c5158a2c9f0ce1fa84715faa46003877d9d27620e7b91079f1090d61809d83f18a291c28b0005d92f0b2640a8c2dbbe60568057e94e29d72d0ed

Download Submit
C:\Windows\Cursors\e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d.exe

Filesize
1.9MB

MD5
1c9af5d654c202419372a238d70cf99e

SHA1
c04476ab4907b766c325cd71e13383f513a58431

SHA256
15cabe0f81ba42ffa2dfa8dec65b2ed383cdf6d9b715c6bc4353d36a67a6105c

SHA512
fce78d68e4244e051c12a6be333904df019cc458145445048257be69ae00476bb54dad6d9e1c066898daa7ba7464a515960e8dd5cc75616ee6f693dfc9d1debf

Download Submit
C:\Windows\Vss\Writers\System\OSPPSVC.exe

Filesize
1.9MB

MD5
88c85713b28206515423821dce1f0a0b

SHA1
3b8372f2cdf9875b21e189634f50661cf4d40a2c

SHA256
e37c63b72b4dd8c6a148989a74f33e54278e68275a33bcd9bab0dbac29e5af0d

SHA512
26e7cf21280bf49336462cfcf229ea6a8c72c3241c0398e85e9fb3f2fe50d174e3bb1f0215f784767034a4b1ecbe59d61e02bf4541014612bd0e30f67f5a6a07

Download Submit
memory/348-389-0x0000000001330000-0x000000000151A000-memory.dmp

Filesize
1.9MB

Download
memory/912-401-0x0000000000140000-0x000000000032A000-memory.dmp

Filesize
1.9MB

Download
memory/912-402-0x00000000006E0000-0x0000000000736000-memory.dmp

Filesize
344KB

Download
memory/952-426-0x0000000000C40000-0x0000000000C96000-memory.dmp

Filesize
344KB

Download
memory/1532-414-0x0000000000DE0000-0x0000000000FCA000-memory.dmp

Filesize
1.9MB

Download
memory/2280-342-0x00000000007F0000-0x0000000000802000-memory.dmp

Filesize
72KB

Download
memory/2280-341-0x0000000000840000-0x0000000000A2A000-memory.dmp

Filesize
1.9MB

Download
memory/2312-13-0x000000001AD60000-0x000000001AD6C000-memory.dmp

Filesize
48KB

Download
memory/2312-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Filesize
4KB

Download
memory/2312-204-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Filesize
4KB

Download
memory/2312-256-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2312-1-0x0000000000BE0000-0x0000000000DCA000-memory.dmp

Filesize
1.9MB

Download
memory/2312-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2312-18-0x000000001AFA0000-0x000000001AFAC000-memory.dmp

Filesize
48KB

Download
memory/2312-17-0x000000001AF90000-0x000000001AF9C000-memory.dmp

Filesize
48KB

Download
memory/2312-16-0x000000001AF80000-0x000000001AF88000-memory.dmp

Filesize
32KB

Download
memory/2312-15-0x000000001AF70000-0x000000001AF7E000-memory.dmp

Filesize
56KB

Download
memory/2312-14-0x000000001AF60000-0x000000001AF6A000-memory.dmp

Filesize
40KB

Download
memory/2312-3-0x0000000000BC0000-0x0000000000BDC000-memory.dmp

Filesize
112KB

Download
memory/2312-4-0x0000000000450000-0x0000000000458000-memory.dmp

Filesize
32KB

Download
memory/2312-222-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/2312-5-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/2312-12-0x000000001A960000-0x000000001A972000-memory.dmp

Filesize
72KB

Download
memory/2312-10-0x000000001A7C0000-0x000000001A7C8000-memory.dmp

Filesize
32KB

Download
memory/2312-9-0x00000000021D0000-0x00000000021DC000-memory.dmp

Filesize
48KB

Download
memory/2312-8-0x000000001AF10000-0x000000001AF66000-memory.dmp

Filesize
344KB

Download
memory/2312-7-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download
memory/2312-6-0x000000001A940000-0x000000001A956000-memory.dmp

Filesize
88KB

Download
memory/2340-438-0x00000000005F0000-0x0000000000602000-memory.dmp

Filesize
72KB

Download
memory/2436-366-0x0000000000AA0000-0x0000000000AF6000-memory.dmp

Filesize
344KB

Download
memory/2500-354-0x00000000011F0000-0x0000000001246000-memory.dmp

Filesize
344KB

Download
memory/2500-353-0x0000000001240000-0x000000000142A000-memory.dmp

Filesize
1.9MB

Download
memory/2500-258-0x0000000000360000-0x0000000000368000-memory.dmp

Filesize
32KB

Download
memory/2500-257-0x000000001B770000-0x000000001BA52000-memory.dmp

Filesize
2.9MB

Download