6681cb73deb0effc4f44f704c6bddb07e98c1f8da4c8478cca7ddd49abdb0c3f

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

192f0f1221e376146e725a4d23ee69a0.exe
Size

1.9MB
MD5

192f0f1221e376146e725a4d23ee69a0
SHA1

9500b9672eac1b1b2dee0e81f8b8efbb6d0d90ff
SHA256

019443010d028a6d5828afc530b1bd568e536afe32e715fe6a771f3ee1a3cc9d
SHA512

daab36e062d27fd7a62607eb16a6013523fafabb31618e681feeae2fc92eb93d43c1f1a8051849aee4839d8b025ccf7227f5081847fd7b2c78e6f233f8d25a54
SSDEEP

24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 33 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2548	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1680	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	556	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1868	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1348	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1752	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2248	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1804	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2904	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	552	2904	schtasks.exe	28

UAC bypass 3 TTPs 27 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2728	powershell.exe
2732	powershell.exe
2712	powershell.exe
2608	powershell.exe
2228	powershell.exe
2276	powershell.exe
2420	powershell.exe
1620	powershell.exe
2724	powershell.exe
2372	powershell.exe
2128	powershell.exe
1736	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	192f0f1221e376146e725a4d23ee69a0.exe

Executes dropped EXE 8 IoCs

pid	Process
1740	audiodg.exe
1512	audiodg.exe
3036	audiodg.exe
2216	audiodg.exe
1164	audiodg.exe
1748	audiodg.exe
2752	audiodg.exe
1828	audiodg.exe

Checks whether UAC is enabled 1 TTPs 18 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	audiodg.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\fr-FR\69ddcba757bf72	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Windows Media Player\fr-FR\dllhost.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\fr-FR\RCX6F24.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Windows Media Player\fr-FR\5940a34987c991	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Windows Sidebar\fr-FR\smss.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\42af1c969fbb7b	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\fr-FR\RCX6F25.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\RCX7B00.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\RCX6A40.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\RCX6A41.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows Media Player\fr-FR\dllhost.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\fr-FR\smss.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\RCX7B01.tmp	192f0f1221e376146e725a4d23ee69a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 33 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1680	schtasks.exe
1816	schtasks.exe
1964	schtasks.exe
3052	schtasks.exe
2540	schtasks.exe
1096	schtasks.exe
2976	schtasks.exe
1868	schtasks.exe
1984	schtasks.exe
2828	schtasks.exe
2548	schtasks.exe
556	schtasks.exe
292	schtasks.exe
1752	schtasks.exe
640	schtasks.exe
2576	schtasks.exe
1492	schtasks.exe
1932	schtasks.exe
1992	schtasks.exe
552	schtasks.exe
2616	schtasks.exe
2708	schtasks.exe
2664	schtasks.exe
2524	schtasks.exe
2596	schtasks.exe
2144	schtasks.exe
2532	schtasks.exe
1348	schtasks.exe
1672	schtasks.exe
808	schtasks.exe
2600	schtasks.exe
2248	schtasks.exe
1804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2280	192f0f1221e376146e725a4d23ee69a0.exe
2280	192f0f1221e376146e725a4d23ee69a0.exe
2280	192f0f1221e376146e725a4d23ee69a0.exe
2128	powershell.exe
1736	powershell.exe
2420	powershell.exe
2712	powershell.exe
2372	powershell.exe
1620	powershell.exe
2276	powershell.exe
2728	powershell.exe
2608	powershell.exe
2724	powershell.exe
2732	powershell.exe
2228	powershell.exe
1740	audiodg.exe
1512	audiodg.exe
3036	audiodg.exe
2216	audiodg.exe
1164	audiodg.exe
1748	audiodg.exe
2752	audiodg.exe
1828	audiodg.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	192f0f1221e376146e725a4d23ee69a0.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeDebugPrivilege	1740	audiodg.exe
Token: SeDebugPrivilege	1512	audiodg.exe
Token: SeDebugPrivilege	3036	audiodg.exe
Token: SeDebugPrivilege	2216	audiodg.exe
Token: SeDebugPrivilege	1164	audiodg.exe
Token: SeDebugPrivilege	1748	audiodg.exe
Token: SeDebugPrivilege	2752	audiodg.exe
Token: SeDebugPrivilege	1828	audiodg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1620	2280	192f0f1221e376146e725a4d23ee69a0.exe	62
PID 2280 wrote to memory of 1620	2280	192f0f1221e376146e725a4d23ee69a0.exe	62
PID 2280 wrote to memory of 1620	2280	192f0f1221e376146e725a4d23ee69a0.exe	62
PID 2280 wrote to memory of 2420	2280	192f0f1221e376146e725a4d23ee69a0.exe	96
PID 2280 wrote to memory of 2420	2280	192f0f1221e376146e725a4d23ee69a0.exe	96
PID 2280 wrote to memory of 2420	2280	192f0f1221e376146e725a4d23ee69a0.exe	96
PID 2280 wrote to memory of 1736	2280	192f0f1221e376146e725a4d23ee69a0.exe	64
PID 2280 wrote to memory of 1736	2280	192f0f1221e376146e725a4d23ee69a0.exe	64
PID 2280 wrote to memory of 1736	2280	192f0f1221e376146e725a4d23ee69a0.exe	64
PID 2280 wrote to memory of 2276	2280	192f0f1221e376146e725a4d23ee69a0.exe	65
PID 2280 wrote to memory of 2276	2280	192f0f1221e376146e725a4d23ee69a0.exe	65
PID 2280 wrote to memory of 2276	2280	192f0f1221e376146e725a4d23ee69a0.exe	65
PID 2280 wrote to memory of 2128	2280	192f0f1221e376146e725a4d23ee69a0.exe	67
PID 2280 wrote to memory of 2128	2280	192f0f1221e376146e725a4d23ee69a0.exe	67
PID 2280 wrote to memory of 2128	2280	192f0f1221e376146e725a4d23ee69a0.exe	67
PID 2280 wrote to memory of 2228	2280	192f0f1221e376146e725a4d23ee69a0.exe	68
PID 2280 wrote to memory of 2228	2280	192f0f1221e376146e725a4d23ee69a0.exe	68
PID 2280 wrote to memory of 2228	2280	192f0f1221e376146e725a4d23ee69a0.exe	68
PID 2280 wrote to memory of 2608	2280	192f0f1221e376146e725a4d23ee69a0.exe	69
PID 2280 wrote to memory of 2608	2280	192f0f1221e376146e725a4d23ee69a0.exe	69
PID 2280 wrote to memory of 2608	2280	192f0f1221e376146e725a4d23ee69a0.exe	69
PID 2280 wrote to memory of 2712	2280	192f0f1221e376146e725a4d23ee69a0.exe	71
PID 2280 wrote to memory of 2712	2280	192f0f1221e376146e725a4d23ee69a0.exe	71
PID 2280 wrote to memory of 2712	2280	192f0f1221e376146e725a4d23ee69a0.exe	71
PID 2280 wrote to memory of 2732	2280	192f0f1221e376146e725a4d23ee69a0.exe	72
PID 2280 wrote to memory of 2732	2280	192f0f1221e376146e725a4d23ee69a0.exe	72
PID 2280 wrote to memory of 2732	2280	192f0f1221e376146e725a4d23ee69a0.exe	72
PID 2280 wrote to memory of 2728	2280	192f0f1221e376146e725a4d23ee69a0.exe	73
PID 2280 wrote to memory of 2728	2280	192f0f1221e376146e725a4d23ee69a0.exe	73
PID 2280 wrote to memory of 2728	2280	192f0f1221e376146e725a4d23ee69a0.exe	73
PID 2280 wrote to memory of 2372	2280	192f0f1221e376146e725a4d23ee69a0.exe	74
PID 2280 wrote to memory of 2372	2280	192f0f1221e376146e725a4d23ee69a0.exe	74
PID 2280 wrote to memory of 2372	2280	192f0f1221e376146e725a4d23ee69a0.exe	74
PID 2280 wrote to memory of 2724	2280	192f0f1221e376146e725a4d23ee69a0.exe	75
PID 2280 wrote to memory of 2724	2280	192f0f1221e376146e725a4d23ee69a0.exe	75
PID 2280 wrote to memory of 2724	2280	192f0f1221e376146e725a4d23ee69a0.exe	75
PID 2280 wrote to memory of 1740	2280	192f0f1221e376146e725a4d23ee69a0.exe	86
PID 2280 wrote to memory of 1740	2280	192f0f1221e376146e725a4d23ee69a0.exe	86
PID 2280 wrote to memory of 1740	2280	192f0f1221e376146e725a4d23ee69a0.exe	86
PID 1740 wrote to memory of 2200	1740	audiodg.exe	87
PID 1740 wrote to memory of 2200	1740	audiodg.exe	87
PID 1740 wrote to memory of 2200	1740	audiodg.exe	87
PID 1740 wrote to memory of 1928	1740	audiodg.exe	88
PID 1740 wrote to memory of 1928	1740	audiodg.exe	88
PID 1740 wrote to memory of 1928	1740	audiodg.exe	88
PID 2200 wrote to memory of 1512	2200	WScript.exe	89
PID 2200 wrote to memory of 1512	2200	WScript.exe	89
PID 2200 wrote to memory of 1512	2200	WScript.exe	89
PID 1512 wrote to memory of 1764	1512	audiodg.exe	90
PID 1512 wrote to memory of 1764	1512	audiodg.exe	90
PID 1512 wrote to memory of 1764	1512	audiodg.exe	90
PID 1512 wrote to memory of 2428	1512	audiodg.exe	91
PID 1512 wrote to memory of 2428	1512	audiodg.exe	91
PID 1512 wrote to memory of 2428	1512	audiodg.exe	91
PID 1764 wrote to memory of 3036	1764	WScript.exe	94
PID 1764 wrote to memory of 3036	1764	WScript.exe	94
PID 1764 wrote to memory of 3036	1764	WScript.exe	94
PID 3036 wrote to memory of 3048	3036	audiodg.exe	95
PID 3036 wrote to memory of 3048	3036	audiodg.exe	95
PID 3036 wrote to memory of 3048	3036	audiodg.exe	95
PID 3036 wrote to memory of 2420	3036	audiodg.exe	96
PID 3036 wrote to memory of 2420	3036	audiodg.exe	96
PID 3036 wrote to memory of 2420	3036	audiodg.exe	96
PID 3048 wrote to memory of 2216	3048	WScript.exe	97

System policy modification 1 TTPs 27 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	audiodg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\192f0f1221e376146e725a4d23ee69a0.exe
"C:\Users\Admin\AppData\Local\Temp\192f0f1221e376146e725a4d23ee69a0.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\192f0f1221e376146e725a4d23ee69a0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Templates\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\fr-FR\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\fr-FR\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\192f0f1221e376146e725a4d23ee69a0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\192f0f1221e376146e725a4d23ee69a0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe
  "C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1740
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02e82330-10e4-4d69-9ac7-ae20e57401a6.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe
      "C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1512
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3ad17da4-5d28-4cd3-a423-197244fd6b37.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe
        
        "C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3036
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0b4bf8ee-f19c-4b34-b84f-556cf4df2999.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe
        
        "C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2216
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e482dfe-79c2-45b2-844d-0acd5076dd8a.vbs"
        9⤵
        
        PID:2992
        
        C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe
        
        "C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1164
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\071b134e-531d-47df-b1b7-f33365a13a85.vbs"
        11⤵
        
        PID:1744
        
        C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe
        
        "C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1748
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3b3cfbd5-f0bf-4992-ad0e-9d99381e32ea.vbs"
        13⤵
        
        PID:1512
        
        C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe
        
        "C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2752
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9aa2486c-af8f-4add-bc44-5514dd129b38.vbs"
        15⤵
        
        PID:2736
        
        C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe
        
        "C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe"
        16⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\35759043-3256-4dbb-a295-53a22ceb79d6.vbs"
        17⤵
        
        PID:2796
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\95a67844-932d-4545-8d20-5741a0100290.vbs"
        17⤵
        
        PID:2544
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e97fc3e9-eb6c-4165-a7b0-564e1470c976.vbs"
        15⤵
        
        PID:1140
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\773797a4-d74c-4eff-bdd0-ddc240bd6cca.vbs"
        13⤵
        
        PID:2144
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cc235d5d-142a-4fc2-a493-2f9f613403bc.vbs"
        11⤵
        
        PID:2132
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a2e8eb5e-cd31-40f9-81bc-38767d6b7880.vbs"
        9⤵
        
        PID:1324
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0f95aca8-b736-4c7b-86e9-e0f13a37da05.vbs"
        7⤵
        
        PID:2420
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\84943063-e335-42af-b71f-b023053a5e6b.vbs"
        5⤵
        
        PID:2428
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\000a36eb-8f05-429d-855f-89b30d664d3d.vbs"
    3⤵
    PID:1928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Templates\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\Templates\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Templates\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\fr-FR\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Media Player\fr-FR\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\fr-FR\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\fr-FR\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\fr-FR\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "192f0f1221e376146e725a4d23ee69a01" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\192f0f1221e376146e725a4d23ee69a0.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "192f0f1221e376146e725a4d23ee69a0" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\192f0f1221e376146e725a4d23ee69a0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "192f0f1221e376146e725a4d23ee69a01" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\192f0f1221e376146e725a4d23ee69a0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "192f0f1221e376146e725a4d23ee69a01" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\192f0f1221e376146e725a4d23ee69a0.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "192f0f1221e376146e725a4d23ee69a0" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\192f0f1221e376146e725a4d23ee69a0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "192f0f1221e376146e725a4d23ee69a01" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\192f0f1221e376146e725a4d23ee69a0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Office14\1033\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\192f0f1221e376146e725a4d23ee69a0.exe

Filesize
1.9MB

MD5
4082314399ef9432f746d09ddeba93bd

SHA1
4365fa6112e0e6b5fb3b7c6ab1c08b79c8fa721b

SHA256
ef58eeb4cf44148e62370990d952b04a8749f27bf1338a6cae4e91ea99049040

SHA512
d4c378d7500dd5bea61766f89cc699113cffdf69ad7541889c76be267e04da42eb7e9ba411b8be385ea2d1d74fa3c3468bfbe91f95b94751494810752cbb574d

Download Submit
C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\smss.exe

Filesize
1.9MB

MD5
192f0f1221e376146e725a4d23ee69a0

SHA1
9500b9672eac1b1b2dee0e81f8b8efbb6d0d90ff

SHA256
019443010d028a6d5828afc530b1bd568e536afe32e715fe6a771f3ee1a3cc9d

SHA512
daab36e062d27fd7a62607eb16a6013523fafabb31618e681feeae2fc92eb93d43c1f1a8051849aee4839d8b025ccf7227f5081847fd7b2c78e6f233f8d25a54

Download Submit
C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\smss.exe

Filesize
1.9MB

MD5
c525e1d9ff51e646742e7c6403469529

SHA1
28e5050a7657af750630854b5aced9c905ab7a2c

SHA256
ba26c630cffe91736feb9c17258770bc9416828b8a3fd3feb30f2016aba1d6e1

SHA512
9d62218b92b454620f654d305cddc86c04c978c60eb512735b56556928e1cacc270c7cea0065a09eee4a3e72a437f66c1c14d3f29788a38369d966803f80e5db

Download Submit
C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\spoolsv.exe

Filesize
1.9MB

MD5
1d34a4062408c41685f98d3552a8ac2d

SHA1
3fcc24ee7da60f71b563cf360a395178274d83fe

SHA256
fde44434ca762a577c4f2840b3029eed88e91c41ec6ef2ae28473a6606035402

SHA512
50b75e117397301f3acc1ae2f362cec75d061c45789011c57e0b3e2a8bbd4ce673f5bc081df3d64d589dbfb7ab95a297dd1a04804f39adc2c8b579f3e56018fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\000a36eb-8f05-429d-855f-89b30d664d3d.vbs

Filesize
511B

MD5
b76eb07a43724a1abd0f255b4a18ae54

SHA1
d432e154aaed126f85cbb0f9a6fb9e86ea6690b8

SHA256
0dc17a8271ff4e59c2b9f03b0c92727cbf40428628b7779e3a9c2018dee2bd38

SHA512
a77412116a45e3498d0db7f008f7220777844b155fff6ebd946c07f155a553013c7b58e510cfbf9b2d4a17d565c94108e722ccbb5b47df09bdb91c6b3880629d

Download Submit
C:\Users\Admin\AppData\Local\Temp\02e82330-10e4-4d69-9ac7-ae20e57401a6.vbs

Filesize
735B

MD5
0d0d3de3358243b3f86178f207867bd4

SHA1
fad78c801830da5f828fecee992279f1186a0a60

SHA256
63dc8e286131d64c43bb997a1f6285eaca66946cf31a213ea6166cfd1b53337a

SHA512
343c795fd3260ae434f80ac894c32139d25ab043967a0f6369a2481e1ec72f3647d28151ea762e6a0950eb6630fa8c9b592bebf3bcada62adb1ffd0925d85193

Download Submit
C:\Users\Admin\AppData\Local\Temp\071b134e-531d-47df-b1b7-f33365a13a85.vbs

Filesize
735B

MD5
1c1fb7e7eaff7a849c91a681e172598f

SHA1
9c8645b6bf491c9da40f4072758fedcc674317f7

SHA256
815bee69e3790c16eee1f79cd0aebfd1935d1d80248664dd0b0d45672719675c

SHA512
a4d37cbafef139cad93add21af4ebe0444b976de41ee498c4ed384627f4d1ce0c8bbe5548318a38ba016edf2456f8b1431d2e1df4507dff5cd0fc1b717dd1569

Download Submit
C:\Users\Admin\AppData\Local\Temp\0b4bf8ee-f19c-4b34-b84f-556cf4df2999.vbs

Filesize
735B

MD5
4d27bcab7652be26e04e6c20efba3b06

SHA1
befd13c8a1e6bef14cba0c5132d55a2061324700

SHA256
ff0a44b592cfa886108b18a0bd313baa2af59a65909bb855d864fab6edefe7db

SHA512
ad39822d324cc645db71b92af81c770dd86e56f2b8d900f058fcf68e0cd86ba9a07369d48b2e6876865f9a9f6a7ce70d8831e533400fd994b6fe798f0544f374

Download Submit
C:\Users\Admin\AppData\Local\Temp\35759043-3256-4dbb-a295-53a22ceb79d6.vbs

Filesize
735B

MD5
c2a150fb928ca9efc370146e13a49ff0

SHA1
cb3b5b1a2c1641466827837f0543c98a52b51146

SHA256
e279e09607455b6fe7e5210b368a2cbb94f485ca341c4622facd4e86701ccb08

SHA512
05f954315dc988ec32e4559a5585ccb7c9559d897b5fef47ae294c40dfec61b88fb07a48789a2289f751fc0d051ff948dff64ff17a47cbe4ef3d02f35eafa8da

Download Submit
C:\Users\Admin\AppData\Local\Temp\3ad17da4-5d28-4cd3-a423-197244fd6b37.vbs

Filesize
735B

MD5
b6cc3157632624ad3ec1b198aea0db7d

SHA1
44ca5d291f8ad3e5367bc97deb3ed05b30101deb

SHA256
714e73935e73cc28c6ee37614b3c35c64d534b97336a88849e88f12a29e1af09

SHA512
a80f9c7664e9e11dabfd07a10bda576f9dbb6c4aa6bd2e405517d8c0fb8efbf105cf8622aefe42b9238f9df11189e1e1c9d6fc9016cf4617b79088389aa192ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\3b3cfbd5-f0bf-4992-ad0e-9d99381e32ea.vbs

Filesize
735B

MD5
ad6208c1c901a1458291f59bc3a660d7

SHA1
77fcbabbc38d067960f2b8dac95c6c521b34ceb3

SHA256
6fc1848997af117e009920bf33929ef8f2ea0e614c83f1f283d3ab2c0b6db012

SHA512
08b955647310ce25b8d14f839df80244d21c3eb35c147596dd2bf6cf71691ff0c564eafe2ac47ab72edb118193fb6b404709c6c5b07f502c9c7ce55d0547b58a

Download Submit
C:\Users\Admin\AppData\Local\Temp\3e482dfe-79c2-45b2-844d-0acd5076dd8a.vbs

Filesize
735B

MD5
6e9b538a9e02c38aa2477eb65f3b2720

SHA1
a0620edf4f3a4be162ffde2d998d690450119e52

SHA256
49b595e6a4633b09c8d6fcfa079807333f98ab4ed1a8c08fa3f6f73b28facd23

SHA512
102dbe7038494a4979bbc51c1a32eb35363315c69280e521e2b3805e832929f8b2ab47cdecf0ef6c6dd8babbc05070c7a57075e9f8bb46f9068b0d2fefe7680d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9aa2486c-af8f-4add-bc44-5514dd129b38.vbs

Filesize
735B

MD5
0b0749de7c4301b78b8350e9251fa22e

SHA1
476e3228368a092a257adac380741417d2bb0d94

SHA256
afbb0ac0be3b7ae469ef2b2478b3357dd689aec71f913e4f3fe1ba76a2eb67fc

SHA512
be02fb5cc0623819cfe1e73363a6539071407c89e9a1a33542a1109a77e7cae665e0322d188b10fd9074dbdcdf2dff97b525736db8b6961a7c413a23a7908e49

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
bb00fa18531eb39ea0f379e3ac0b5713

SHA1
35806a59a3cfb75a8efa321b7d077e5702b08e44

SHA256
54b5b1d9a6fd1db968e4792e52059e8a3cb682e99a0a467d0e0b3cd4dd507ec3

SHA512
654fdbc7d0d6aed33a075fe422362f198d43735da004245bdf80591545dbea9d830bb092014c14cf8b7d84151a17e8bd92c15de216747611b431e41d84d713ef

Download Submit
memory/1512-251-0x0000000000BE0000-0x0000000000BF2000-memory.dmp

Filesize
72KB

Download
memory/1512-250-0x0000000000BF0000-0x0000000000DDA000-memory.dmp

Filesize
1.9MB

Download
memory/1736-196-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/1740-239-0x0000000000560000-0x0000000000572000-memory.dmp

Filesize
72KB

Download
memory/1740-195-0x0000000000980000-0x0000000000B6A000-memory.dmp

Filesize
1.9MB

Download
memory/1748-298-0x0000000001190000-0x000000000137A000-memory.dmp

Filesize
1.9MB

Download
memory/2128-194-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2216-275-0x0000000001040000-0x000000000122A000-memory.dmp

Filesize
1.9MB

Download
memory/2280-13-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Filesize
48KB

Download
memory/2280-7-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

Filesize
40KB

Download
memory/2280-14-0x000000001AE20000-0x000000001AE2A000-memory.dmp

Filesize
40KB

Download
memory/2280-16-0x000000001AE40000-0x000000001AE48000-memory.dmp

Filesize
32KB

Download
memory/2280-234-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/2280-17-0x000000001AE50000-0x000000001AE5C000-memory.dmp

Filesize
48KB

Download
memory/2280-18-0x000000001AEE0000-0x000000001AEEC000-memory.dmp

Filesize
48KB

Download
memory/2280-15-0x000000001AE30000-0x000000001AE3E000-memory.dmp

Filesize
56KB

Download
memory/2280-0-0x000007FEF5233000-0x000007FEF5234000-memory.dmp

Filesize
4KB

Download
memory/2280-9-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Filesize
48KB

Download
memory/2280-10-0x0000000000C40000-0x0000000000C48000-memory.dmp

Filesize
32KB

Download
memory/2280-1-0x0000000000F80000-0x000000000116A000-memory.dmp

Filesize
1.9MB

Download
memory/2280-12-0x0000000000C50000-0x0000000000C62000-memory.dmp

Filesize
72KB

Download
memory/2280-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2280-5-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download
memory/2280-6-0x0000000000560000-0x0000000000576000-memory.dmp

Filesize
88KB

Download
memory/2280-8-0x000000001ADD0000-0x000000001AE26000-memory.dmp

Filesize
344KB

Download
memory/2280-3-0x0000000000530000-0x000000000054C000-memory.dmp

Filesize
112KB

Download
memory/2280-2-0x000007FEF5230000-0x000007FEF5C1C000-memory.dmp

Filesize
9.9MB

Download
memory/2752-311-0x0000000001240000-0x0000000001252000-memory.dmp

Filesize
72KB

Download
memory/2752-310-0x0000000001250000-0x000000000143A000-memory.dmp

Filesize
1.9MB

Download
memory/3036-263-0x0000000000250000-0x000000000043A000-memory.dmp

Filesize
1.9MB

Download