df025008bab8a9d1b780276526007d60abaafb894af2cca82bc633c715945ec5

Analysis

max time kernel
95s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

441b1668aa7980a3ec40cf151cea5f5d.exe
Size

1.9MB
MD5

441b1668aa7980a3ec40cf151cea5f5d
SHA1

c38963f651a4a062fb712e9fbe7cb39cb9b4b0f5
SHA256

8fff8f0b312deb03f0f95f4df36073a6b5da22b83d571151c7b5d0ee4837c06a
SHA512

299c3014e97c402f59d8878ed67e406ada3b277c3d43a1c4e698c825e27631c8acf3987459f588d3e02d7a7d7b4f0e656b641a56d11ba1bfca2e813a1e9fa817
SSDEEP

24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 27 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4196	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3172	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4768	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3756	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	116	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4860	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4496	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4068	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	632	212	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	212	schtasks.exe	88

UAC bypass 3 TTPs 21 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2296	powershell.exe
5076	powershell.exe
4588	powershell.exe
3232	powershell.exe
3048	powershell.exe
3312	powershell.exe
4424	powershell.exe
4736	powershell.exe
1316	powershell.exe
2380	powershell.exe
1120	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	441b1668aa7980a3ec40cf151cea5f5d.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	dwm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	441b1668aa7980a3ec40cf151cea5f5d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	441b1668aa7980a3ec40cf151cea5f5d.exe

Executes dropped EXE 6 IoCs

pid	Process
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
1576	dwm.exe
3584	dwm.exe
532	dwm.exe
1808	dwm.exe
2852	dwm.exe

Checks whether UAC is enabled 1 TTPs 14 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dwm.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Photo Viewer\de-DE\dllhost.exe	441b1668aa7980a3ec40cf151cea5f5d.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\de-DE\dllhost.exe	441b1668aa7980a3ec40cf151cea5f5d.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\5940a34987c991	441b1668aa7980a3ec40cf151cea5f5d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\9e8d7a4ca61bd9	441b1668aa7980a3ec40cf151cea5f5d.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\de-DE\RCX8FFD.tmp	441b1668aa7980a3ec40cf151cea5f5d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\RCX9213.tmp	441b1668aa7980a3ec40cf151cea5f5d.exe
File created	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\0a1fd5f707cd16	441b1668aa7980a3ec40cf151cea5f5d.exe
File created	C:\Program Files\Google\6203df4a6bafc7	441b1668aa7980a3ec40cf151cea5f5d.exe
File created	C:\Program Files\Google\lsass.exe	441b1668aa7980a3ec40cf151cea5f5d.exe
File opened for modification	C:\Program Files\Google\lsass.exe	441b1668aa7980a3ec40cf151cea5f5d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\RuntimeBroker.exe	441b1668aa7980a3ec40cf151cea5f5d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\RuntimeBroker.exe	441b1668aa7980a3ec40cf151cea5f5d.exe
File created	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\sppsvc.exe	441b1668aa7980a3ec40cf151cea5f5d.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\de-DE\RCX8FFE.tmp	441b1668aa7980a3ec40cf151cea5f5d.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\RCX9212.tmp	441b1668aa7980a3ec40cf151cea5f5d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\sppsvc.exe	441b1668aa7980a3ec40cf151cea5f5d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceState\EventLog\Data\Registry.exe	441b1668aa7980a3ec40cf151cea5f5d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	441b1668aa7980a3ec40cf151cea5f5d.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	441b1668aa7980a3ec40cf151cea5f5d.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4220	schtasks.exe
4768	schtasks.exe
3700	schtasks.exe
5112	schtasks.exe
632	schtasks.exe
2224	schtasks.exe
4076	schtasks.exe
4964	schtasks.exe
4600	schtasks.exe
3712	schtasks.exe
4220	schtasks.exe
116	schtasks.exe
824	schtasks.exe
468	schtasks.exe
4848	schtasks.exe
4012	schtasks.exe
3756	schtasks.exe
4092	schtasks.exe
4196	schtasks.exe
2444	schtasks.exe
3172	schtasks.exe
2444	schtasks.exe
1404	schtasks.exe
4860	schtasks.exe
4496	schtasks.exe
4068	schtasks.exe
4060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4620	441b1668aa7980a3ec40cf151cea5f5d.exe
3312	powershell.exe
4736	powershell.exe
5076	powershell.exe
5076	powershell.exe
4424	powershell.exe
4424	powershell.exe
3312	powershell.exe
3312	powershell.exe
4424	powershell.exe
4736	powershell.exe
4736	powershell.exe
5076	powershell.exe
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
4488	441b1668aa7980a3ec40cf151cea5f5d.exe
4588	powershell.exe
4588	powershell.exe
3232	powershell.exe
3048	powershell.exe
3232	powershell.exe
3048	powershell.exe
2296	powershell.exe
2296	powershell.exe
1120	powershell.exe
1120	powershell.exe
2380	powershell.exe
2380	powershell.exe
1316	powershell.exe
1316	powershell.exe
4588	powershell.exe
3232	powershell.exe
3048	powershell.exe
2296	powershell.exe
1120	powershell.exe
2380	powershell.exe
1316	powershell.exe
1576	dwm.exe
3584	dwm.exe
3584	dwm.exe
532	dwm.exe
1808	dwm.exe
2852	dwm.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	441b1668aa7980a3ec40cf151cea5f5d.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	4736	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	4488	441b1668aa7980a3ec40cf151cea5f5d.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	1576	dwm.exe
Token: SeDebugPrivilege	3584	dwm.exe
Token: SeDebugPrivilege	532	dwm.exe
Token: SeDebugPrivilege	1808	dwm.exe
Token: SeDebugPrivilege	2852	dwm.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4736	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	98
PID 4620 wrote to memory of 4736	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	98
PID 4620 wrote to memory of 4424	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	99
PID 4620 wrote to memory of 4424	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	99
PID 4620 wrote to memory of 3312	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	100
PID 4620 wrote to memory of 3312	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	100
PID 4620 wrote to memory of 5076	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	102
PID 4620 wrote to memory of 5076	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	102
PID 4620 wrote to memory of 4684	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	106
PID 4620 wrote to memory of 4684	4620	441b1668aa7980a3ec40cf151cea5f5d.exe	106
PID 4684 wrote to memory of 2352	4684	cmd.exe	108
PID 4684 wrote to memory of 2352	4684	cmd.exe	108
PID 4684 wrote to memory of 4488	4684	cmd.exe	109
PID 4684 wrote to memory of 4488	4684	cmd.exe	109
PID 4488 wrote to memory of 2296	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	131
PID 4488 wrote to memory of 2296	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	131
PID 4488 wrote to memory of 3048	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	132
PID 4488 wrote to memory of 3048	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	132
PID 4488 wrote to memory of 3232	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	133
PID 4488 wrote to memory of 3232	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	133
PID 4488 wrote to memory of 4588	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	134
PID 4488 wrote to memory of 4588	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	134
PID 4488 wrote to memory of 1120	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	136
PID 4488 wrote to memory of 1120	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	136
PID 4488 wrote to memory of 2380	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	137
PID 4488 wrote to memory of 2380	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	137
PID 4488 wrote to memory of 1316	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	139
PID 4488 wrote to memory of 1316	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	139
PID 4488 wrote to memory of 1576	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	146
PID 4488 wrote to memory of 1576	4488	441b1668aa7980a3ec40cf151cea5f5d.exe	146
PID 1576 wrote to memory of 1616	1576	dwm.exe	147
PID 1576 wrote to memory of 1616	1576	dwm.exe	147
PID 1576 wrote to memory of 2608	1576	dwm.exe	148
PID 1576 wrote to memory of 2608	1576	dwm.exe	148
PID 1616 wrote to memory of 3584	1616	WScript.exe	156
PID 1616 wrote to memory of 3584	1616	WScript.exe	156
PID 3584 wrote to memory of 1904	3584	dwm.exe	157
PID 3584 wrote to memory of 1904	3584	dwm.exe	157
PID 3584 wrote to memory of 3464	3584	dwm.exe	158
PID 3584 wrote to memory of 3464	3584	dwm.exe	158
PID 1904 wrote to memory of 532	1904	WScript.exe	162
PID 1904 wrote to memory of 532	1904	WScript.exe	162
PID 532 wrote to memory of 3828	532	dwm.exe	163
PID 532 wrote to memory of 3828	532	dwm.exe	163
PID 532 wrote to memory of 4368	532	dwm.exe	164
PID 532 wrote to memory of 4368	532	dwm.exe	164
PID 3828 wrote to memory of 1808	3828	WScript.exe	165
PID 3828 wrote to memory of 1808	3828	WScript.exe	165
PID 1808 wrote to memory of 2192	1808	dwm.exe	166
PID 1808 wrote to memory of 2192	1808	dwm.exe	166
PID 1808 wrote to memory of 3540	1808	dwm.exe	167
PID 1808 wrote to memory of 3540	1808	dwm.exe	167
PID 2192 wrote to memory of 2852	2192	WScript.exe	169
PID 2192 wrote to memory of 2852	2192	WScript.exe	169
PID 2852 wrote to memory of 2864	2852	dwm.exe	170
PID 2852 wrote to memory of 2864	2852	dwm.exe	170
PID 2852 wrote to memory of 4436	2852	dwm.exe	171
PID 2852 wrote to memory of 4436	2852	dwm.exe	171

System policy modification 1 TTPs 21 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	441b1668aa7980a3ec40cf151cea5f5d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dwm.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\441b1668aa7980a3ec40cf151cea5f5d.exe
"C:\Users\Admin\AppData\Local\Temp\441b1668aa7980a3ec40cf151cea5f5d.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\441b1668aa7980a3ec40cf151cea5f5d.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\de-DE\dllhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VZ7SOkg1XF.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\441b1668aa7980a3ec40cf151cea5f5d.exe
    "C:\Users\Admin\AppData\Local\Temp\441b1668aa7980a3ec40cf151cea5f5d.exe"
    3⤵
    - UAC bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\441b1668aa7980a3ec40cf151cea5f5d.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\fontdrvhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\dwm.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\sppsvc.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\lsass.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\3ac54ddf2ad44faa6035cf\sihost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\0154351536fc379faee1\wininit.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1316
  - - C:\0154351536fc379faee1\dwm.exe
      "C:\0154351536fc379faee1\dwm.exe"
      4⤵
      UAC bypass
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:1576
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e2b8650c-b106-4baf-ad15-b6a21bb7b45b.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1616
      - C:\0154351536fc379faee1\dwm.exe
        
        C:\0154351536fc379faee1\dwm.exe
        6⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:3584
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\711e9c86-15c4-44d6-8426-94cf8410648c.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\0154351536fc379faee1\dwm.exe
        
        C:\0154351536fc379faee1\dwm.exe
        8⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d92266d3-3e6c-42a5-8ced-5790836654c4.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\0154351536fc379faee1\dwm.exe
        
        C:\0154351536fc379faee1\dwm.exe
        10⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1808
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ec98489-f659-497f-995f-7718e50fc105.vbs"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\0154351536fc379faee1\dwm.exe
        
        C:\0154351536fc379faee1\dwm.exe
        12⤵
        UAC bypass
        Checks computer location settings
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2852
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\435b46cb-9609-4e68-82ac-dcae0fef76b6.vbs"
        13⤵
        
        PID:2864
        
        C:\0154351536fc379faee1\dwm.exe
        
        C:\0154351536fc379faee1\dwm.exe
        14⤵
        
        PID:612
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\81264464-c609-4f37-9ab7-e76396dd7703.vbs"
        15⤵
        
        PID:3176
        
        C:\0154351536fc379faee1\dwm.exe
        
        C:\0154351536fc379faee1\dwm.exe
        16⤵
        
        PID:4780
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1c560b47-2ad9-4eec-b9b0-2c424bb1db9f.vbs"
        17⤵
        
        PID:3500
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\521177c9-8eac-41fa-8c1a-919f4ba6a41d.vbs"
        17⤵
        
        PID:2184
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\07d1a66b-6af2-44ec-8bd5-fb312dd2de0a.vbs"
        15⤵
        
        PID:1056
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d52db28-3543-4fa2-be1d-96ca91af93a5.vbs"
        13⤵
        
        PID:4436
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c948d6c9-f920-45c1-a97d-9680534337f0.vbs"
        11⤵
        
        PID:3540
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\227154fb-9a14-455d-908f-cf651ec07be0.vbs"
        9⤵
        
        PID:4368
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3a3a2a6-a826-4181-8153-72dc111a757e.vbs"
        7⤵
        
        PID:3464
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\79dd6f08-d9d4-4f08-957e-6fddf11da25d.vbs"
        5⤵
        
        PID:2608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\de-DE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\de-DE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\Trust Protection Lists\Mu\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\0154351536fc379faee1\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\0154351536fc379faee1\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\0154351536fc379faee1\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\3ac54ddf2ad44faa6035cf\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\3ac54ddf2ad44faa6035cf\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\0154351536fc379faee1\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\0154351536fc379faee1\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\0154351536fc379faee1\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Google\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Google\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\3ac54ddf2ad44faa6035cf\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\3ac54ddf2ad44faa6035cf\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\3ac54ddf2ad44faa6035cf\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\0154351536fc379faee1\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\0154351536fc379faee1\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\0154351536fc379faee1\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\0154351536fc379faee1\fontdrvhost.exe

Filesize
1.9MB

MD5
82b59c85a314c62469cecbf0871bdc5f

SHA1
69b8af686744ff518e3af5d5d130d79c5af00b5c

SHA256
e596463a3eb03ed8c64b933c00919ca58eddd27554b719af1275de41b4359f03

SHA512
cdd004998afe20b210886e15b4dcd6325c2303882a5f81c6791a867b434e4c9b99b3f01c62343e5bc87ceebf67c0d7d25c7b5e80151833cc01322bfebfeeae77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\441b1668aa7980a3ec40cf151cea5f5d.exe.log

Filesize
1KB

MD5
364147c1feef3565925ea5b4ac701a01

SHA1
9a46393ac3ffad3bb3c8f0e074b65d68d75e21ef

SHA256
38cf1ab1146ad24e88763fc0508c2a99478d8428b453ba8c8b830d2883a4562b

SHA512
bfec1d3f22abd5668def189259deb4d919ceb4d51ac965d0baf9b6cf8bea0db680d49a2b8d0b75524cc04c7803cdfd91e484b31dc8ddc3ff47d1e5c59a9e35cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
164a45e66dbe5b4c1fad9ced25394a84

SHA1
5f90cf92b891734679ddb12be560b2ec4c6282d7

SHA256
e8f1393a9e1a21ef9c18231e6d1301624694e6036ec8ddf1234219eb96222a28

SHA512
d05e8eebd235ed67a9a4c8f13004cf576df60ae068b81cd11a9d3de69cde110bf3983005a55adac948c5e8f5843b44c865b56dad4d8a37de3d2e442c4ef2eb55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
555e68af1b8e33f84346bf2335e6191a

SHA1
fa078ed3a608f05ae2dd2db8ed52d6bafe8d510e

SHA256
91a76a2c6c73116293fb7e5bfb12b00ef8128a04fbbb44153f4fd63794b2b8ae

SHA512
6f3d5be098271b844d0cbd21d902e68ce80f0bcfa67e3fb507d11bacf15227d3e66397fec2691d7f3333194d4d2067ea416bcbb1d9739f661db3bab0259af44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
029fbf628b046653ab7ff10b31deeeb2

SHA1
93c2cb1905c8f5e71f5ea97a1e8a8c891eae077c

SHA256
85f6b0971e94daf9fd4e39413824f162851a9f5ce7f989bd92c903a4dbcbef26

SHA512
d4e3626dba2572bd1e53446b384962f955cc0c7e56a72cacf50a845d74714ec1020bcb0fdcc50636a1dfd4f08dc34143dbb5638dd90180df6aa31dab9228c98c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d14ccefeb263594e60b1765e131f7a3

SHA1
4a9ebdc0dff58645406c40b7b140e1b174756721

SHA256
57cd435c8b2bf10a2c77698301789c032e1b6b623ff1420c72e8bca0b10f1e5c

SHA512
2013a26123f72a4106524fd9d7389ac4654f97033d22707efc084fb2a3ad01c298eb64f01bb64861ab603615022dbe7cfc97475346edb16b3ba72e905127f101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cc19bcff372d20459d3651ba8aef50e7

SHA1
3c6f1d4cdd647864fb97a16b1aefba67fcee11f7

SHA256
366473e774d8976c7fd4dc582220666fb61a4feb3f7c95e69b2a68ad9e446ec9

SHA512
a0e360ca4b6e874fd44612bf4b17f3722c0619da4f6bade12a62efadae88c2d33460114eaafa2bc3fb1cef5bea07e745b8bee24f15d0cacaff5f4a521b225080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
815f9e54d2e55a6cd87a044f75fdba0c

SHA1
9e2c91b5d015a2f96539227ed0a5d83cf26f6c08

SHA256
ec7d07723ca9c032e3662c0a316318065854ed4dc54106a5214278cbd148e75f

SHA512
9198d94b9d3ef35693881e3dc3e1c7f4b42d98f23a27f58cec67309628504de6940f0ac58bff1de2923b9d1b2dd11be82ea98bad9419d2e22f610df01c7401a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
a9a7f35c006bbf5da72f9cb250ffbddb

SHA1
458a8cedc38dac109631d9fccb3bf6d2c5c0e89e

SHA256
a1db56d56e35a6c95f98204e40f69f70422969681d408e5edc4afbf732eef86b

SHA512
d341773d30e09214567c65f24cd1854f1e438b8528aa30d35b6baac16e671dde1245edda654f19343b7c160da45985ab53f08453e7f6286e272d544f8741c131

Download Submit
C:\Users\Admin\AppData\Local\Temp\1c560b47-2ad9-4eec-b9b0-2c424bb1db9f.vbs

Filesize
707B

MD5
1701fbb8e9b4e63a9d0b155b78d3c7b5

SHA1
6ef363a4da621c81293532f82b60204e0ac93ee4

SHA256
e43abf82f7031979bbaf47b88bea9bb6ee3df1937d8ed08fc3b10a73350495df

SHA512
e17805e44d01dc6b84c476a08a917b96aab234739bbb796f776584d9ea631a78dc32e67a9ae2282f1891cf30e6da824b2446ed38cfa92aa80eb40c03c7a9f4ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\435b46cb-9609-4e68-82ac-dcae0fef76b6.vbs

Filesize
707B

MD5
a2f85c3c10637b67a10c5dd381662974

SHA1
4638bbc08e183a4a0cf231253edf758831bae6a8

SHA256
2207038f71f8ef224780641560edaf54a8d50141936d52fdbd5107d917efe305

SHA512
da2074019df227998b2d3526f3c39e23a3d2a31f30396da6f6c3e6d0aac1d03c49fdb8bdd62df21341d8391008b2ad51d6dc53019ab7ab3d0abf804a8161ddb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ec98489-f659-497f-995f-7718e50fc105.vbs

Filesize
707B

MD5
0c465c86ffede4497b5769ebe7103cd6

SHA1
f53834d902734c6c90737ad6364b3e0166b62396

SHA256
2f68d66dcd4b2ad3de875cbb6fd4d3324c68508cb14962ab378f86860ce5935c

SHA512
d04d4b70c65f8a410b87932fd2ddfbc3bcb0b78ba6241403408fd739b0c6035bf4eec9a26bd3cef1ccbf540338236c4bec76dee57703e6398a8d027dd36af596

Download Submit
C:\Users\Admin\AppData\Local\Temp\711e9c86-15c4-44d6-8426-94cf8410648c.vbs

Filesize
707B

MD5
32b68678f7eb2082ee4a5ab5812896ec

SHA1
0566e9845461d379c81c822ee401fda96b0f5516

SHA256
c891fdac20653b2078ecb42e913a45edb182ad9042ee7d90e5049d7bcb2594b9

SHA512
15a83357a0268a8d9504ec11f95c86cf833833d205e5c767e0fba5b859255db6a7f9fe6f67d10ce9212c6695a3c22c305b687cb2ca6cc014bec60f7645bc2fe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\79dd6f08-d9d4-4f08-957e-6fddf11da25d.vbs

Filesize
483B

MD5
f087adbfa67db7b9ed164f2eb08608d6

SHA1
d65721f0c55d223bf66cf9d8e942aa3c05f6a9e4

SHA256
d3b51a0d98d011cb613394ff9bc16731a2611a76077d9789eb1040e0132e69c0

SHA512
df702aa69d0e95f50bfc8ce513b7fddb9def156498b92dc6e3bee5083202099233e24d5a597210f682a68a1d053f703bc0df6b3dbefabdb6c34fbf69ac091126

Download Submit
C:\Users\Admin\AppData\Local\Temp\81264464-c609-4f37-9ab7-e76396dd7703.vbs

Filesize
706B

MD5
cb23d6daa8041866e7d1fe1dfb5b37a9

SHA1
5dc026b3a64e455f3c89a05f0a56dab1f058aa5c

SHA256
ea927f477563369d67178c3dc1e6103f129d4f5362aaf1dfa043dbd23964208c

SHA512
edf3bffd6b50dbc2403ca557a84fc8d4f4e61168e28dc83d3cfe27fb5c07f998c2598209ac0366f33e10ee473a4767fbf2350ab2f44cefffa4a4004f9be68fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCX8DF9.tmp

Filesize
1.9MB

MD5
441b1668aa7980a3ec40cf151cea5f5d

SHA1
c38963f651a4a062fb712e9fbe7cb39cb9b4b0f5

SHA256
8fff8f0b312deb03f0f95f4df36073a6b5da22b83d571151c7b5d0ee4837c06a

SHA512
299c3014e97c402f59d8878ed67e406ada3b277c3d43a1c4e698c825e27631c8acf3987459f588d3e02d7a7d7b4f0e656b641a56d11ba1bfca2e813a1e9fa817

Download Submit
C:\Users\Admin\AppData\Local\Temp\VZ7SOkg1XF.bat

Filesize
235B

MD5
53c87f0143b2c40bd094682ff2887c5b

SHA1
2550c555ad4d3fc73881b613749a10a139a203a2

SHA256
ea0ae9bc9612952b7d3c29a0803d517208d3bd3013ddea52cd7246c5d6a0bbb9

SHA512
59ca6f303936b1bd000f11ce55bf994ae8f62f467bf6e2814046f43ea18b0586f747763a8d51bd754b5b8574493b151d919bef1c96ebc27d67d63234df5314db

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uurlyjbl.qai.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\d55df18342801a2c24ff6a2ffc2c1a886e6e9ed7.exe

Filesize
1.1MB

MD5
66f419af74e0d0a9cc75549dcf3b8e49

SHA1
85c90e24588bab5e2f56a32107735b142f4efc97

SHA256
5cbdc19f80ce52532ffd4f489e0cc8886071047f052831f19c383a58ab86e04f

SHA512
0ecddfb65bebc70a267f0c00b37938e5003badac5f00caf3e63459041b087aadf3a640155d8b485a7c75ed6528145c771837d5bc9ddc9d1d710c55be6d881151

Download Submit
C:\Users\Admin\AppData\Local\Temp\d92266d3-3e6c-42a5-8ced-5790836654c4.vbs

Filesize
706B

MD5
9d83daa3199ebf6e317a1c760b524488

SHA1
1235c2d657d42f0bc9fc2a2ba27a26866d85fd8d

SHA256
95042e833ec69ffd1c6b423e84a99b547c76878df7df7e4c99aef979ee48d27f

SHA512
2a689ddef085d9c44c38fb1e3fc7835c618c997d27b6523b3d244723e6568606e313d17684572b790f7c8811d18d1271e8c0cb1e009e914b3714dd317f5ada51

Download Submit
C:\Users\Admin\AppData\Local\Temp\e2b8650c-b106-4baf-ad15-b6a21bb7b45b.vbs

Filesize
707B

MD5
4b534caa4a97b5d66e3e39815314b8aa

SHA1
ac16d830733f5c04a60d8fa45c946ff1bf86ee86

SHA256
69c3f9350b9fe6eee84ae347a8f832a552b564d4d899a2f2b28616deda760a10

SHA512
38d1bd98df3a3b08f2d981c82a4dd914338b34eeec6f41838fcbeff0c9ae34784c31e6458c0cf2623ed37621d0c30ff38a0767f9e61bc97fcfe4156b86188f4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA2DEA.tmp

Filesize
640B

MD5
a3b2675e172d5a8e837525c3ec89186b

SHA1
78104e1892a19f1e4c9b8c9050cc825f3237daf9

SHA256
be8659ec1f48afbe2a517e1f8cae5e6c50f05205f94d4576968c1d38a95b379c

SHA512
fa4aa62a2681194616eb6cf7a5c99adeb75531e41d5e7dee43af3e4dc8c2be299d503fcc098bc30001dd415aaf09dd248205d58f49652db1ec616ebdad1d115e

Download Submit
memory/612-343-0x000000001B2D0000-0x000000001B2E2000-memory.dmp

Filesize
72KB

Download
memory/1808-319-0x000000001B830000-0x000000001B886000-memory.dmp

Filesize
344KB

Download
memory/2852-331-0x000000001BCE0000-0x000000001BD36000-memory.dmp

Filesize
344KB

Download
memory/3312-78-0x0000020466790000-0x00000204667B2000-memory.dmp

Filesize
136KB

Download
memory/3584-296-0x000000001B5B0000-0x000000001B606000-memory.dmp

Filesize
344KB

Download
memory/4488-124-0x000000001B630000-0x000000001B642000-memory.dmp

Filesize
72KB

Download
memory/4620-13-0x000000001B3C0000-0x000000001B3D2000-memory.dmp

Filesize
72KB

Download
memory/4620-8-0x0000000002A10000-0x0000000002A1A000-memory.dmp

Filesize
40KB

Download
memory/4620-20-0x000000001B440000-0x000000001B44C000-memory.dmp

Filesize
48KB

Download
memory/4620-19-0x000000001B430000-0x000000001B43C000-memory.dmp

Filesize
48KB

Download
memory/4620-10-0x0000000002A20000-0x0000000002A2C000-memory.dmp

Filesize
48KB

Download
memory/4620-9-0x000000001B370000-0x000000001B3C6000-memory.dmp

Filesize
344KB

Download
memory/4620-4-0x0000000002A30000-0x0000000002A80000-memory.dmp

Filesize
320KB

Download
memory/4620-5-0x0000000001120000-0x0000000001128000-memory.dmp

Filesize
32KB

Download
memory/4620-18-0x000000001B420000-0x000000001B428000-memory.dmp

Filesize
32KB

Download
memory/4620-7-0x00000000029F0000-0x0000000002A06000-memory.dmp

Filesize
88KB

Download
memory/4620-17-0x000000001B410000-0x000000001B41E000-memory.dmp

Filesize
56KB

Download
memory/4620-14-0x000000001C5F0000-0x000000001CB18000-memory.dmp

Filesize
5.2MB

Download
memory/4620-16-0x000000001B400000-0x000000001B40A000-memory.dmp

Filesize
40KB

Download
memory/4620-102-0x00007FF9A35F0000-0x00007FF9A40B1000-memory.dmp

Filesize
10.8MB

Download
memory/4620-6-0x00000000029E0000-0x00000000029F0000-memory.dmp

Filesize
64KB

Download
memory/4620-1-0x00000000005C0000-0x00000000007AA000-memory.dmp

Filesize
1.9MB

Download
memory/4620-3-0x0000000001100000-0x000000000111C000-memory.dmp

Filesize
112KB

Download
memory/4620-15-0x000000001B3F0000-0x000000001B3FC000-memory.dmp

Filesize
48KB

Download
memory/4620-2-0x00007FF9A35F0000-0x00007FF9A40B1000-memory.dmp

Filesize
10.8MB

Download
memory/4620-11-0x0000000002A80000-0x0000000002A88000-memory.dmp

Filesize
32KB

Download
memory/4620-0-0x00007FF9A35F3000-0x00007FF9A35F5000-memory.dmp

Filesize
8KB

Download