6681cb73deb0effc4f44f704c6bddb07e98c1f8da4c8478cca7ddd49abdb0c3f

Analysis

max time kernel
150s
max time network
161s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

192f0f1221e376146e725a4d23ee69a0.exe
Size

1.9MB
MD5

192f0f1221e376146e725a4d23ee69a0
SHA1

9500b9672eac1b1b2dee0e81f8b8efbb6d0d90ff
SHA256

019443010d028a6d5828afc530b1bd568e536afe32e715fe6a771f3ee1a3cc9d
SHA512

daab36e062d27fd7a62607eb16a6013523fafabb31618e681feeae2fc92eb93d43c1f1a8051849aee4839d8b025ccf7227f5081847fd7b2c78e6f233f8d25a54
SSDEEP

24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2768	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2816	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2648	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1536	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	696	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2968	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	292	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1256	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2436	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1432	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1988	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2832	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	908	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2168	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	2884	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1120	2884	schtasks.exe	30

UAC bypass 3 TTPs 24 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2944	powershell.exe
2304	powershell.exe
1828	powershell.exe
2364	powershell.exe
2360	powershell.exe
2896	powershell.exe
2552	powershell.exe
2416	powershell.exe
1616	powershell.exe
1824	powershell.exe
1680	powershell.exe
2876	powershell.exe
2156	powershell.exe
1148	powershell.exe
2620	powershell.exe
2968	powershell.exe
2392	powershell.exe
3008	powershell.exe
3016	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	192f0f1221e376146e725a4d23ee69a0.exe

Executes dropped EXE 7 IoCs

pid	Process
768	Idle.exe
912	Idle.exe
1360	Idle.exe
2916	Idle.exe
832	Idle.exe
912	Idle.exe
2200	Idle.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe

Drops file in Program Files directory 55 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\RCXE5FE.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\RCXE5FF.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\winlogon.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Google\CrashReports\cc11b995f2a76d	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXBFAA.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXD192.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\192f0f1221e376146e725a4d23ee69a0.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\winlogon.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\RCXC662.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\Idle.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Google\Chrome\Application\27d1bcfc3c54e0	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCXC8D4.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\RCXCB46.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\RCXCD89.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\6ccacd8608530f	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\0a1fd5f707cd16	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Windows Mail\1610b97d3ab4a7	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\Idle.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\RCXD3A6.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\dwm.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXE38C.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\winlogon.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCXD193.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows Mail\fr-FR\RCXD3B7.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCXD628.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\RCXD629.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\RCXD89A.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\RCXD89B.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXE38D.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Windows NT\TableTextService\7a0fd90576e088	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Java\jdk1.7.0_80\cc11b995f2a76d	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Windows Mail\OSPPSVC.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\RCXC661.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Windows Portable Devices\886983d96e3d3e	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\6ccacd8608530f	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Google\Chrome\Application\System.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Windows Mail\fr-FR\dwm.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\192f0f1221e376146e725a4d23ee69a0.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows Portable Devices\csrss.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files (x86)\Google\CrashReports\winlogon.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Windows Portable Devices\csrss.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Windows Mail\fr-FR\6cb0b6c459d5d3	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\Windows NT\TableTextService\explorer.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Google\CrashReports\RCXBF2C.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows Portable Devices\RCXC866.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\RCXCAD8.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\046b773a97cb66	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\RCXCD69.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\System.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\explorer.exe	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\OSPPSVC.exe	192f0f1221e376146e725a4d23ee69a0.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\AppPatch\Custom\Custom64\csrss.exe	192f0f1221e376146e725a4d23ee69a0.exe
File created	C:\Windows\AppPatch\Custom\Custom64\886983d96e3d3e	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Windows\AppPatch\Custom\Custom64\RCXE870.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Windows\AppPatch\Custom\Custom64\RCXE871.tmp	192f0f1221e376146e725a4d23ee69a0.exe
File opened for modification	C:\Windows\AppPatch\Custom\Custom64\csrss.exe	192f0f1221e376146e725a4d23ee69a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2060	schtasks.exe
2832	schtasks.exe
1152	schtasks.exe
2440	schtasks.exe
2704	schtasks.exe
2436	schtasks.exe
1364	schtasks.exe
2304	schtasks.exe
1120	schtasks.exe
976	schtasks.exe
1988	schtasks.exe
2392	schtasks.exe
1224	schtasks.exe
2768	schtasks.exe
1984	schtasks.exe
1536	schtasks.exe
1016	schtasks.exe
292	schtasks.exe
1032	schtasks.exe
908	schtasks.exe
856	schtasks.exe
2132	schtasks.exe
1640	schtasks.exe
1736	schtasks.exe
2476	schtasks.exe
1616	schtasks.exe
2856	schtasks.exe
2916	schtasks.exe
2872	schtasks.exe
2648	schtasks.exe
2624	schtasks.exe
1492	schtasks.exe
3008	schtasks.exe
1792	schtasks.exe
2708	schtasks.exe
2244	schtasks.exe
2968	schtasks.exe
2344	schtasks.exe
2416	schtasks.exe
1432	schtasks.exe
860	schtasks.exe
1956	schtasks.exe
1920	schtasks.exe
1084	schtasks.exe
1036	schtasks.exe
2564	schtasks.exe
2168	schtasks.exe
1656	schtasks.exe
1960	schtasks.exe
2836	schtasks.exe
2816	schtasks.exe
696	schtasks.exe
2044	schtasks.exe
1256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1712	192f0f1221e376146e725a4d23ee69a0.exe
1712	192f0f1221e376146e725a4d23ee69a0.exe
1712	192f0f1221e376146e725a4d23ee69a0.exe
1712	192f0f1221e376146e725a4d23ee69a0.exe
1712	192f0f1221e376146e725a4d23ee69a0.exe
1712	192f0f1221e376146e725a4d23ee69a0.exe
1712	192f0f1221e376146e725a4d23ee69a0.exe
1712	192f0f1221e376146e725a4d23ee69a0.exe
1712	192f0f1221e376146e725a4d23ee69a0.exe
2392	powershell.exe
2416	powershell.exe
2620	powershell.exe
1828	powershell.exe
2968	powershell.exe
2876	powershell.exe
2552	powershell.exe
2896	powershell.exe
2360	powershell.exe
2364	powershell.exe
3016	powershell.exe
1680	powershell.exe
2304	powershell.exe
2944	powershell.exe
1148	powershell.exe
1824	powershell.exe
2156	powershell.exe
1616	powershell.exe
3008	powershell.exe
768	Idle.exe
912	Idle.exe
1360	Idle.exe
2916	Idle.exe
832	Idle.exe
912	Idle.exe
2200	Idle.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	192f0f1221e376146e725a4d23ee69a0.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	768	Idle.exe
Token: SeDebugPrivilege	912	Idle.exe
Token: SeDebugPrivilege	1360	Idle.exe
Token: SeDebugPrivilege	2916	Idle.exe
Token: SeDebugPrivilege	832	Idle.exe
Token: SeDebugPrivilege	912	Idle.exe
Token: SeDebugPrivilege	2200	Idle.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2620	1712	192f0f1221e376146e725a4d23ee69a0.exe	86
PID 1712 wrote to memory of 2620	1712	192f0f1221e376146e725a4d23ee69a0.exe	86
PID 1712 wrote to memory of 2620	1712	192f0f1221e376146e725a4d23ee69a0.exe	86
PID 1712 wrote to memory of 1680	1712	192f0f1221e376146e725a4d23ee69a0.exe	87
PID 1712 wrote to memory of 1680	1712	192f0f1221e376146e725a4d23ee69a0.exe	87
PID 1712 wrote to memory of 1680	1712	192f0f1221e376146e725a4d23ee69a0.exe	87
PID 1712 wrote to memory of 2968	1712	192f0f1221e376146e725a4d23ee69a0.exe	88
PID 1712 wrote to memory of 2968	1712	192f0f1221e376146e725a4d23ee69a0.exe	88
PID 1712 wrote to memory of 2968	1712	192f0f1221e376146e725a4d23ee69a0.exe	88
PID 1712 wrote to memory of 1828	1712	192f0f1221e376146e725a4d23ee69a0.exe	90
PID 1712 wrote to memory of 1828	1712	192f0f1221e376146e725a4d23ee69a0.exe	90
PID 1712 wrote to memory of 1828	1712	192f0f1221e376146e725a4d23ee69a0.exe	90
PID 1712 wrote to memory of 2392	1712	192f0f1221e376146e725a4d23ee69a0.exe	91
PID 1712 wrote to memory of 2392	1712	192f0f1221e376146e725a4d23ee69a0.exe	91
PID 1712 wrote to memory of 2392	1712	192f0f1221e376146e725a4d23ee69a0.exe	91
PID 1712 wrote to memory of 2364	1712	192f0f1221e376146e725a4d23ee69a0.exe	92
PID 1712 wrote to memory of 2364	1712	192f0f1221e376146e725a4d23ee69a0.exe	92
PID 1712 wrote to memory of 2364	1712	192f0f1221e376146e725a4d23ee69a0.exe	92
PID 1712 wrote to memory of 2876	1712	192f0f1221e376146e725a4d23ee69a0.exe	93
PID 1712 wrote to memory of 2876	1712	192f0f1221e376146e725a4d23ee69a0.exe	93
PID 1712 wrote to memory of 2876	1712	192f0f1221e376146e725a4d23ee69a0.exe	93
PID 1712 wrote to memory of 2896	1712	192f0f1221e376146e725a4d23ee69a0.exe	94
PID 1712 wrote to memory of 2896	1712	192f0f1221e376146e725a4d23ee69a0.exe	94
PID 1712 wrote to memory of 2896	1712	192f0f1221e376146e725a4d23ee69a0.exe	94
PID 1712 wrote to memory of 2360	1712	192f0f1221e376146e725a4d23ee69a0.exe	97
PID 1712 wrote to memory of 2360	1712	192f0f1221e376146e725a4d23ee69a0.exe	97
PID 1712 wrote to memory of 2360	1712	192f0f1221e376146e725a4d23ee69a0.exe	97
PID 1712 wrote to memory of 3008	1712	192f0f1221e376146e725a4d23ee69a0.exe	99
PID 1712 wrote to memory of 3008	1712	192f0f1221e376146e725a4d23ee69a0.exe	99
PID 1712 wrote to memory of 3008	1712	192f0f1221e376146e725a4d23ee69a0.exe	99
PID 1712 wrote to memory of 2156	1712	192f0f1221e376146e725a4d23ee69a0.exe	100
PID 1712 wrote to memory of 2156	1712	192f0f1221e376146e725a4d23ee69a0.exe	100
PID 1712 wrote to memory of 2156	1712	192f0f1221e376146e725a4d23ee69a0.exe	100
PID 1712 wrote to memory of 3016	1712	192f0f1221e376146e725a4d23ee69a0.exe	101
PID 1712 wrote to memory of 3016	1712	192f0f1221e376146e725a4d23ee69a0.exe	101
PID 1712 wrote to memory of 3016	1712	192f0f1221e376146e725a4d23ee69a0.exe	101
PID 1712 wrote to memory of 1616	1712	192f0f1221e376146e725a4d23ee69a0.exe	102
PID 1712 wrote to memory of 1616	1712	192f0f1221e376146e725a4d23ee69a0.exe	102
PID 1712 wrote to memory of 1616	1712	192f0f1221e376146e725a4d23ee69a0.exe	102
PID 1712 wrote to memory of 2552	1712	192f0f1221e376146e725a4d23ee69a0.exe	103
PID 1712 wrote to memory of 2552	1712	192f0f1221e376146e725a4d23ee69a0.exe	103
PID 1712 wrote to memory of 2552	1712	192f0f1221e376146e725a4d23ee69a0.exe	103
PID 1712 wrote to memory of 1824	1712	192f0f1221e376146e725a4d23ee69a0.exe	104
PID 1712 wrote to memory of 1824	1712	192f0f1221e376146e725a4d23ee69a0.exe	104
PID 1712 wrote to memory of 1824	1712	192f0f1221e376146e725a4d23ee69a0.exe	104
PID 1712 wrote to memory of 2304	1712	192f0f1221e376146e725a4d23ee69a0.exe	105
PID 1712 wrote to memory of 2304	1712	192f0f1221e376146e725a4d23ee69a0.exe	105
PID 1712 wrote to memory of 2304	1712	192f0f1221e376146e725a4d23ee69a0.exe	105
PID 1712 wrote to memory of 2944	1712	192f0f1221e376146e725a4d23ee69a0.exe	107
PID 1712 wrote to memory of 2944	1712	192f0f1221e376146e725a4d23ee69a0.exe	107
PID 1712 wrote to memory of 2944	1712	192f0f1221e376146e725a4d23ee69a0.exe	107
PID 1712 wrote to memory of 1148	1712	192f0f1221e376146e725a4d23ee69a0.exe	109
PID 1712 wrote to memory of 1148	1712	192f0f1221e376146e725a4d23ee69a0.exe	109
PID 1712 wrote to memory of 1148	1712	192f0f1221e376146e725a4d23ee69a0.exe	109
PID 1712 wrote to memory of 2416	1712	192f0f1221e376146e725a4d23ee69a0.exe	111
PID 1712 wrote to memory of 2416	1712	192f0f1221e376146e725a4d23ee69a0.exe	111
PID 1712 wrote to memory of 2416	1712	192f0f1221e376146e725a4d23ee69a0.exe	111
PID 1712 wrote to memory of 768	1712	192f0f1221e376146e725a4d23ee69a0.exe	124
PID 1712 wrote to memory of 768	1712	192f0f1221e376146e725a4d23ee69a0.exe	124
PID 1712 wrote to memory of 768	1712	192f0f1221e376146e725a4d23ee69a0.exe	124
PID 768 wrote to memory of 1620	768	Idle.exe	125
PID 768 wrote to memory of 1620	768	Idle.exe	125
PID 768 wrote to memory of 1620	768	Idle.exe	125
PID 768 wrote to memory of 2376	768	Idle.exe	126

System policy modification 1 TTPs 24 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	192f0f1221e376146e725a4d23ee69a0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Idle.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\192f0f1221e376146e725a4d23ee69a0.exe
"C:\Users\Admin\AppData\Local\Temp\192f0f1221e376146e725a4d23ee69a0.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\192f0f1221e376146e725a4d23ee69a0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\CrashReports\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Favorites\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\System.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Mail\fr-FR\dwm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\192f0f1221e376146e725a4d23ee69a0.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\TableTextService\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\My Documents\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\lsm.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Saved Games\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\OSPPSVC.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk1.7.0_80\winlogon.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\Custom\Custom64\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe
  "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:768
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\367d32be-5bd8-432d-8a4b-cf462ccb5190.vbs"
    3⤵
    PID:1620
  - - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe
      "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:912
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\558e0494-7bb6-46d1-8da6-b7d7bd26b796.vbs"
        5⤵
        
        PID:3068
      - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe"
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1360
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3aa97c8d-c938-4752-be83-cf16ba904cd5.vbs"
        7⤵
        
        PID:1940
        
        C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe"
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2916
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\960df572-8523-4233-a5bc-eabd754d9a2c.vbs"
        9⤵
        
        PID:1668
        
        C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe"
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:832
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7468d560-5b21-4138-aacd-8df13e67b10f.vbs"
        11⤵
        
        PID:2768
        
        C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe"
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:912
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0c162ae6-1789-4fc0-b1e4-cebed116dd99.vbs"
        13⤵
        
        PID:2816
        
        C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe"
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2200
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ecdd0072-ac3f-4e19-a57f-4f9c266bab2a.vbs"
        15⤵
        
        PID:1760
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c1633e71-b672-468f-96e6-9a062db59ddc.vbs"
        15⤵
        
        PID:1984
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dd6069be-d655-4237-83da-dd02e2db6cfc.vbs"
        13⤵
        
        PID:2564
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a38f62d4-ecfe-4316-81c7-15798ac32855.vbs"
        11⤵
        
        PID:1732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3220d702-8c60-4c65-aa9c-7283d27b9f48.vbs"
        9⤵
        
        PID:1632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cdb9f58f-91fa-4bfd-9034-59f39cc2ceed.vbs"
        7⤵
        
        PID:2240
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\17ef93a9-ea76-482e-ae90-a1a15a6afe67.vbs"
        5⤵
        
        PID:2432
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0d7f4857-fd77-4ebf-9743-a7ce76ad4959.vbs"
    3⤵
    PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Google\CrashReports\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\CrashReports\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Favorites\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Favorites\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Google\Chrome\Application\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Google\Chrome\Application\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Mail\fr-FR\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "192f0f1221e376146e725a4d23ee69a01" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\192f0f1221e376146e725a4d23ee69a0.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "192f0f1221e376146e725a4d23ee69a0" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\192f0f1221e376146e725a4d23ee69a0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "192f0f1221e376146e725a4d23ee69a01" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\192f0f1221e376146e725a4d23ee69a0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows NT\TableTextService\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\TableTextService\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Default\My Documents\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\My Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Default\My Documents\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Pictures\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Public\Pictures\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Saved Games\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Saved Games\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\OSPPSVC.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\OSPPSVC.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk1.7.0_80\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Java\jdk1.7.0_80\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jdk1.7.0_80\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Windows\AppPatch\Custom\Custom64\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\AppPatch\Custom\Custom64\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\AppPatch\Custom\Custom64\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\CrashReports\winlogon.exe

Filesize
1.9MB

MD5
9cb7fbe5f1b87bad3ca1337d1e37b4b7

SHA1
df5d3354faba2c8e5c071114c12db899eed42916

SHA256
5fd1991a0955b2bd39ea13283b3d2af42f55fdad3a01983d3152a443a2797fbf

SHA512
b930c4d8ced639e8abf1431fdc472a5578ef12fef5aa0655e53d0a91d4cdb4adcdf4ac409f68c5a2844b96349dd2cb80ccddc8f35cc570b67c2bb53ec8c49d6e

Download Submit
C:\Program Files (x86)\Windows NT\Accessories\fr-FR\Idle.exe

Filesize
1.9MB

MD5
192f0f1221e376146e725a4d23ee69a0

SHA1
9500b9672eac1b1b2dee0e81f8b8efbb6d0d90ff

SHA256
019443010d028a6d5828afc530b1bd568e536afe32e715fe6a771f3ee1a3cc9d

SHA512
daab36e062d27fd7a62607eb16a6013523fafabb31618e681feeae2fc92eb93d43c1f1a8051849aee4839d8b025ccf7227f5081847fd7b2c78e6f233f8d25a54

Download Submit
C:\Program Files (x86)\Windows NT\Accessories\fr-FR\Idle.exe

Filesize
1.9MB

MD5
3c5a8fb0efa0383426f86a52226ec298

SHA1
ed126bfde67434f35faf9c68a4aed275ab7dd450

SHA256
02be0d6a338743310baa7e991f33a636bb3f2ad9556ccd348203a2470d52bb49

SHA512
696f03e29e8aa7df070bdee594e65f729cb96fa9a3b4e7da1d34b4f9c80c7bc21e33f334ff2cff5af284ae9537a60b121a1ee46050179a51e87c3800f2fb094c

Download Submit
C:\Program Files\Windows Portable Devices\csrss.exe

Filesize
1.9MB

MD5
6adc7438bacfd0b487b70b32d9d61129

SHA1
62407c0e86ac037c7e20cbb01044b6f4f39099fd

SHA256
cb4ecf850565228ac3a5e9c481558228c7eecb8bee6949b10c06fd9170d9d739

SHA512
60a20f70b273da351b42083034d59ff9437849cb36371bd869448a1e0a90588a180a43cfe9fbc642c95fa3b4f866966d0ecd635d6d3722583ff7f8ce984d4d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\0c162ae6-1789-4fc0-b1e4-cebed116dd99.vbs

Filesize
749B

MD5
81e88db8bee7dc0592a7cf21f8b2185f

SHA1
b8a056472f6ab7051a26e8ce8b60c7a7bf1954f3

SHA256
7a22a601dd5a555063b41e1bbed6aefe56d7e5682ddb82b94829d3779e1f1a2a

SHA512
cc12da9c42163ba5bd746aa5b97ed01a6104eb14705e2b3ecb239ba7e964af59c27ec54015d8ac736007c97055d8c4d9210234f43db6a431f572e39325899848

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d7f4857-fd77-4ebf-9743-a7ce76ad4959.vbs

Filesize
526B

MD5
0d9197ae2d6d2ee9cc6c414e8b728ddb

SHA1
f970d3ad51c59f23829ab6bf1445f259d466c80d

SHA256
7423a09c27b52eea481d6d941ed24a45e847124a918216b2446e36be3319f244

SHA512
448f90adfa7b77c7d133c8279166e83e57d7f77dde4477a557c6fd211ff7076a01e443584fc37640a2db14f7d107b78d4bf670685d0c587536cb317bfc6997ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\367d32be-5bd8-432d-8a4b-cf462ccb5190.vbs

Filesize
749B

MD5
93f4774599b410a638abacbe153d60af

SHA1
6de2a33667c0256aecd563a0654100a79dc5346f

SHA256
0d3f487d8ad8febb266dfc8d7c8d3c94409144b0d9246d710f56c0dd378c320b

SHA512
3e329d4dd005e4d58d7f8485f760310bf67d083b1a0a79ee95b89e2c47b59b33744d0b477d7a6966216b8ef67728e8d037d0e18c5ac0a1bc89b620d9db032d3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3aa97c8d-c938-4752-be83-cf16ba904cd5.vbs

Filesize
750B

MD5
6b06e4e01885f01958162b9039f754e7

SHA1
72cd843bcd5b8cd2c9af468b57d07c5773d5ceb4

SHA256
b0163a41ab3b82f20cc11f2d551caf5cc723bc34f8b8acee75e9da04113a532c

SHA512
2be77de09f84037b38d940eb0d1d7790b64d85dd8fb56437512fc903a95b6980c0c7aed29922351a7b511ea7dc23500e5edb7c1f65f86e255f7cefebb16bb8dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7468d560-5b21-4138-aacd-8df13e67b10f.vbs

Filesize
749B

MD5
19255de831ad73ccab7ff6b812bd3df1

SHA1
f3b82561a99cc1910049e1b5c3e88fa4d4505a97

SHA256
30dd0b0be876f5a05d7285c9db86f5e47fc8f646171dd873597444bb2ade085b

SHA512
cc548dc0139ddc2ac5cf1a94e6efbb53f594419a7b88a8d88363837924e765545b57bb9cd3c7d6a11dd2c6d288406828e489284460b8acb88b08ee1db96ddfe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\960df572-8523-4233-a5bc-eabd754d9a2c.vbs

Filesize
750B

MD5
03c42b63fea5450ceaef1ea09ed5f925

SHA1
8f07d96e44522bc1562a9276d3275c5a87ce841d

SHA256
3dae5f8fa563e1ae9d2f68ea63ebf1b17b7d1f5c37c8b904a38f3c6479d96b43

SHA512
41f77f7e5c0ceb3680ce5d7a902078e72b7cdaaa41e54c4d5b2fd3ac5b9ca6b3abe00fccfb3b9339c1284c093143234383a6d0fe63c0a088ec3f3b0c45208254

Download Submit
C:\Users\Admin\AppData\Local\Temp\ecdd0072-ac3f-4e19-a57f-4f9c266bab2a.vbs

Filesize
750B

MD5
83c8c006bbe0cc67031dbc1414bceed5

SHA1
08bb71a0f05f67417155722e01106136c82a9efb

SHA256
267277d3945fbb0f71c74d5b8008bf8716ebd192fffff366d63fc8e4afc3dc22

SHA512
4f76ae9a445b66d67c8865f0300f6017bfdcd282f32715e60e9e5f501815290a2ee4b1e319e1fc29520aa8ddd041edcc0b0370d04d4452e2c0cc5c60243ff26f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
55326309b9fbc46af6d66e32f6057a7c

SHA1
4d7e130f0c5a1d049bb8a2c95e1a15d40bdec761

SHA256
9df3a85659ea298b646825000dd9ee6105aa7915236fd5d3e3cc5b83362583ca

SHA512
1df86c638a69ce2ae256e80055c01c38dd61eb313dd87111cb6b728014fe030653653ab2c6ed4d86498bc53021b4ae207458f8249cb1903b76060bb0d25046af

Download Submit
C:\Users\Default\Documents\spoolsv.exe

Filesize
1.9MB

MD5
bff0cebd6b7da74a3c67902ac6e8f49e

SHA1
c76d32fc318ca883b5ac44de6d3b692d4faab86a

SHA256
dbd3675696fb0d87fb51ee41122afcd7fb00a723543ff32133bea4d51dfbf7fc

SHA512
bd24b0bcdd5edf6785e061cd5ab7678bd151c1274500502cce5da43296fd0937802286330c69964684a8e4b479b6b745a5fc4a715236ea8f0223dc35304d5572

Download Submit
C:\Users\Default\Saved Games\OSPPSVC.exe

Filesize
1.9MB

MD5
11045deafaf02537620e3f5a39a7487d

SHA1
6348b067d2c135c4008c4b6cea21cd8a5d93d33b

SHA256
5a72aaddd31152462f2965fe4b1f434a1cb6a665c2b0cc681eb44e67de74ff87

SHA512
c7a588ebe10be7a61ca0f84e1f6970c47237793b2ec63752416ac242b00f850f7ce4198f89276614e3405eb9d3a7b070ab023f9a8cdf216c7a7cfffb7af41db9

Download Submit
C:\Users\Public\Favorites\wininit.exe

Filesize
1.9MB

MD5
7250e8f37879c317955a66be6a84494d

SHA1
6390dc1cd0823a2fe008c16cfee0657f1b5009ff

SHA256
45fe19263445901da1c8f25822442e155fc571ed287f0d58d6791aabb4b40546

SHA512
ba64474733a15b6ec29e9728281257aa54051a46cf7a71a04e0c52761056faccaac7da4c0f63b7ae161587ec5a96a807d259784a076e39e9bdd6a004d4b49413

Download Submit
memory/768-280-0x0000000000370000-0x000000000055A000-memory.dmp

Filesize
1.9MB

Download
memory/832-420-0x00000000004B0000-0x0000000000506000-memory.dmp

Filesize
344KB

Download
memory/912-384-0x0000000000650000-0x0000000000662000-memory.dmp

Filesize
72KB

Download
memory/912-383-0x0000000000220000-0x000000000040A000-memory.dmp

Filesize
1.9MB

Download
memory/1148-301-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/1360-395-0x0000000000B30000-0x0000000000D1A000-memory.dmp

Filesize
1.9MB

Download
memory/1712-0-0x000007FEF5F93000-0x000007FEF5F94000-memory.dmp

Filesize
4KB

Download
memory/1712-1-0x0000000000CE0000-0x0000000000ECA000-memory.dmp

Filesize
1.9MB

Download
memory/1712-174-0x000007FEF5F93000-0x000007FEF5F94000-memory.dmp

Filesize
4KB

Download
memory/1712-199-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download
memory/1712-5-0x0000000000510000-0x0000000000520000-memory.dmp

Filesize
64KB

Download
memory/1712-6-0x0000000000A40000-0x0000000000A56000-memory.dmp

Filesize
88KB

Download
memory/1712-18-0x000000001ADE0000-0x000000001ADEC000-memory.dmp

Filesize
48KB

Download
memory/1712-13-0x0000000000B10000-0x0000000000B1C000-memory.dmp

Filesize
48KB

Download
memory/1712-8-0x00000000023B0000-0x0000000002406000-memory.dmp

Filesize
344KB

Download
memory/1712-14-0x000000001A990000-0x000000001A99A000-memory.dmp

Filesize
40KB

Download
memory/1712-362-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download
memory/1712-2-0x000007FEF5F90000-0x000007FEF697C000-memory.dmp

Filesize
9.9MB

Download
memory/1712-3-0x00000000003D0000-0x00000000003EC000-memory.dmp

Filesize
112KB

Download
memory/1712-4-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download
memory/1712-15-0x000000001A9A0000-0x000000001A9AE000-memory.dmp

Filesize
56KB

Download
memory/1712-7-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/1712-12-0x0000000000B00000-0x0000000000B12000-memory.dmp

Filesize
72KB

Download
memory/1712-10-0x0000000000A70000-0x0000000000A78000-memory.dmp

Filesize
32KB

Download
memory/1712-17-0x000000001ADD0000-0x000000001ADDC000-memory.dmp

Filesize
48KB

Download
memory/1712-9-0x0000000000A60000-0x0000000000A6C000-memory.dmp

Filesize
48KB

Download
memory/1712-16-0x000000001A9B0000-0x000000001A9B8000-memory.dmp

Filesize
32KB

Download
memory/2200-443-0x00000000010D0000-0x00000000012BA000-memory.dmp

Filesize
1.9MB

Download
memory/2200-444-0x0000000000640000-0x0000000000652000-memory.dmp

Filesize
72KB

Download
memory/2392-306-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2916-407-0x0000000001000000-0x00000000011EA000-memory.dmp

Filesize
1.9MB

Download
memory/2916-408-0x0000000000550000-0x0000000000562000-memory.dmp

Filesize
72KB

Download