5e5d5458b8a025c2bc9a6e7998492989732967c9a1019b11d655200adf3686c7

Analysis

max time kernel
146s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82aff6a3f0ad4533029392f48502a7e2.exe
Size

1.9MB
MD5

82aff6a3f0ad4533029392f48502a7e2
SHA1

f895f75e4ca2fa64ea2f7fc8026f7d45d6fb7a63
SHA256

40ea09eeb440e55f9020c374046c518009e516ee3efba244fa94fcf753325d61
SHA512

8f12d8f615b260cd390139a82bc8b8ec70bd383f7c0fc17df86c8edc6d1b2a902bb9c4f40209f7d096ff1ed8c1aac12806972ab14e4fe59248d152b7992134e7
SSDEEP

24576:Uz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:UOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 24 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2764	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2796	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2872	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2704	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2640	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2292	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1180	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1352	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	356	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	2276	schtasks.exe	30
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	2276	schtasks.exe	30

UAC bypass 3 TTPs 24 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	82aff6a3f0ad4533029392f48502a7e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	82aff6a3f0ad4533029392f48502a7e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	82aff6a3f0ad4533029392f48502a7e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2016	powershell.exe
1540	powershell.exe
2360	powershell.exe
2288	powershell.exe
576	powershell.exe
556	powershell.exe
1372	powershell.exe
908	powershell.exe
2216	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	82aff6a3f0ad4533029392f48502a7e2.exe

Executes dropped EXE 7 IoCs

pid	Process
3044	csrss.exe
448	csrss.exe
2632	csrss.exe
1952	csrss.exe
1756	csrss.exe
1484	csrss.exe
1800	csrss.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	82aff6a3f0ad4533029392f48502a7e2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	82aff6a3f0ad4533029392f48502a7e2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\lsass.exe	82aff6a3f0ad4533029392f48502a7e2.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\7a0fd90576e088	82aff6a3f0ad4533029392f48502a7e2.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCXB3C7.tmp	82aff6a3f0ad4533029392f48502a7e2.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXBABF.tmp	82aff6a3f0ad4533029392f48502a7e2.exe
File opened for modification	C:\Program Files\Windows Media Player\wininit.exe	82aff6a3f0ad4533029392f48502a7e2.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\lsass.exe	82aff6a3f0ad4533029392f48502a7e2.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCXC1C7.tmp	82aff6a3f0ad4533029392f48502a7e2.exe
File created	C:\Program Files\Windows Media Player\wininit.exe	82aff6a3f0ad4533029392f48502a7e2.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCXB435.tmp	82aff6a3f0ad4533029392f48502a7e2.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXBAC0.tmp	82aff6a3f0ad4533029392f48502a7e2.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\6203df4a6bafc7	82aff6a3f0ad4533029392f48502a7e2.exe
File created	C:\Program Files\Windows Media Player\56085415360792	82aff6a3f0ad4533029392f48502a7e2.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe	82aff6a3f0ad4533029392f48502a7e2.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\RCXC236.tmp	82aff6a3f0ad4533029392f48502a7e2.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe	82aff6a3f0ad4533029392f48502a7e2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2872	schtasks.exe
2840	schtasks.exe
1972	schtasks.exe
1724	schtasks.exe
1944	schtasks.exe
2796	schtasks.exe
2812	schtasks.exe
2792	schtasks.exe
1352	schtasks.exe
356	schtasks.exe
1548	schtasks.exe
1476	schtasks.exe
1424	schtasks.exe
2704	schtasks.exe
2640	schtasks.exe
2600	schtasks.exe
2292	schtasks.exe
1180	schtasks.exe
1560	schtasks.exe
1968	schtasks.exe
2460	schtasks.exe
2764	schtasks.exe
2760	schtasks.exe
2828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2008	82aff6a3f0ad4533029392f48502a7e2.exe
2008	82aff6a3f0ad4533029392f48502a7e2.exe
2008	82aff6a3f0ad4533029392f48502a7e2.exe
2008	82aff6a3f0ad4533029392f48502a7e2.exe
2008	82aff6a3f0ad4533029392f48502a7e2.exe
2008	82aff6a3f0ad4533029392f48502a7e2.exe
2008	82aff6a3f0ad4533029392f48502a7e2.exe
2360	powershell.exe
2288	powershell.exe
2216	powershell.exe
1372	powershell.exe
1540	powershell.exe
908	powershell.exe
576	powershell.exe
2016	powershell.exe
556	powershell.exe
3044	csrss.exe
448	csrss.exe
2632	csrss.exe
1952	csrss.exe
1756	csrss.exe
1484	csrss.exe
1800	csrss.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	82aff6a3f0ad4533029392f48502a7e2.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	3044	csrss.exe
Token: SeDebugPrivilege	448	csrss.exe
Token: SeDebugPrivilege	2632	csrss.exe
Token: SeDebugPrivilege	1952	csrss.exe
Token: SeDebugPrivilege	1756	csrss.exe
Token: SeDebugPrivilege	1484	csrss.exe
Token: SeDebugPrivilege	1800	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2016	2008	82aff6a3f0ad4533029392f48502a7e2.exe	55
PID 2008 wrote to memory of 2016	2008	82aff6a3f0ad4533029392f48502a7e2.exe	55
PID 2008 wrote to memory of 2016	2008	82aff6a3f0ad4533029392f48502a7e2.exe	55
PID 2008 wrote to memory of 1540	2008	82aff6a3f0ad4533029392f48502a7e2.exe	56
PID 2008 wrote to memory of 1540	2008	82aff6a3f0ad4533029392f48502a7e2.exe	56
PID 2008 wrote to memory of 1540	2008	82aff6a3f0ad4533029392f48502a7e2.exe	56
PID 2008 wrote to memory of 908	2008	82aff6a3f0ad4533029392f48502a7e2.exe	58
PID 2008 wrote to memory of 908	2008	82aff6a3f0ad4533029392f48502a7e2.exe	58
PID 2008 wrote to memory of 908	2008	82aff6a3f0ad4533029392f48502a7e2.exe	58
PID 2008 wrote to memory of 1372	2008	82aff6a3f0ad4533029392f48502a7e2.exe	59
PID 2008 wrote to memory of 1372	2008	82aff6a3f0ad4533029392f48502a7e2.exe	59
PID 2008 wrote to memory of 1372	2008	82aff6a3f0ad4533029392f48502a7e2.exe	59
PID 2008 wrote to memory of 556	2008	82aff6a3f0ad4533029392f48502a7e2.exe	60
PID 2008 wrote to memory of 556	2008	82aff6a3f0ad4533029392f48502a7e2.exe	60
PID 2008 wrote to memory of 556	2008	82aff6a3f0ad4533029392f48502a7e2.exe	60
PID 2008 wrote to memory of 576	2008	82aff6a3f0ad4533029392f48502a7e2.exe	61
PID 2008 wrote to memory of 576	2008	82aff6a3f0ad4533029392f48502a7e2.exe	61
PID 2008 wrote to memory of 576	2008	82aff6a3f0ad4533029392f48502a7e2.exe	61
PID 2008 wrote to memory of 2216	2008	82aff6a3f0ad4533029392f48502a7e2.exe	62
PID 2008 wrote to memory of 2216	2008	82aff6a3f0ad4533029392f48502a7e2.exe	62
PID 2008 wrote to memory of 2216	2008	82aff6a3f0ad4533029392f48502a7e2.exe	62
PID 2008 wrote to memory of 2288	2008	82aff6a3f0ad4533029392f48502a7e2.exe	63
PID 2008 wrote to memory of 2288	2008	82aff6a3f0ad4533029392f48502a7e2.exe	63
PID 2008 wrote to memory of 2288	2008	82aff6a3f0ad4533029392f48502a7e2.exe	63
PID 2008 wrote to memory of 2360	2008	82aff6a3f0ad4533029392f48502a7e2.exe	64
PID 2008 wrote to memory of 2360	2008	82aff6a3f0ad4533029392f48502a7e2.exe	64
PID 2008 wrote to memory of 2360	2008	82aff6a3f0ad4533029392f48502a7e2.exe	64
PID 2008 wrote to memory of 3044	2008	82aff6a3f0ad4533029392f48502a7e2.exe	73
PID 2008 wrote to memory of 3044	2008	82aff6a3f0ad4533029392f48502a7e2.exe	73
PID 2008 wrote to memory of 3044	2008	82aff6a3f0ad4533029392f48502a7e2.exe	73
PID 3044 wrote to memory of 2044	3044	csrss.exe	75
PID 3044 wrote to memory of 2044	3044	csrss.exe	75
PID 3044 wrote to memory of 2044	3044	csrss.exe	75
PID 3044 wrote to memory of 956	3044	csrss.exe	76
PID 3044 wrote to memory of 956	3044	csrss.exe	76
PID 3044 wrote to memory of 956	3044	csrss.exe	76
PID 2044 wrote to memory of 448	2044	WScript.exe	77
PID 2044 wrote to memory of 448	2044	WScript.exe	77
PID 2044 wrote to memory of 448	2044	WScript.exe	77
PID 448 wrote to memory of 2344	448	csrss.exe	78
PID 448 wrote to memory of 2344	448	csrss.exe	78
PID 448 wrote to memory of 2344	448	csrss.exe	78
PID 448 wrote to memory of 1744	448	csrss.exe	79
PID 448 wrote to memory of 1744	448	csrss.exe	79
PID 448 wrote to memory of 1744	448	csrss.exe	79
PID 2344 wrote to memory of 2632	2344	WScript.exe	80
PID 2344 wrote to memory of 2632	2344	WScript.exe	80
PID 2344 wrote to memory of 2632	2344	WScript.exe	80
PID 2632 wrote to memory of 2792	2632	csrss.exe	81
PID 2632 wrote to memory of 2792	2632	csrss.exe	81
PID 2632 wrote to memory of 2792	2632	csrss.exe	81
PID 2632 wrote to memory of 2848	2632	csrss.exe	82
PID 2632 wrote to memory of 2848	2632	csrss.exe	82
PID 2632 wrote to memory of 2848	2632	csrss.exe	82
PID 2792 wrote to memory of 1952	2792	WScript.exe	83
PID 2792 wrote to memory of 1952	2792	WScript.exe	83
PID 2792 wrote to memory of 1952	2792	WScript.exe	83
PID 1952 wrote to memory of 2016	1952	csrss.exe	84
PID 1952 wrote to memory of 2016	1952	csrss.exe	84
PID 1952 wrote to memory of 2016	1952	csrss.exe	84
PID 1952 wrote to memory of 484	1952	csrss.exe	85
PID 1952 wrote to memory of 484	1952	csrss.exe	85
PID 1952 wrote to memory of 484	1952	csrss.exe	85
PID 2016 wrote to memory of 1756	2016	WScript.exe	86

System policy modification 1 TTPs 24 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	82aff6a3f0ad4533029392f48502a7e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	82aff6a3f0ad4533029392f48502a7e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	82aff6a3f0ad4533029392f48502a7e2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\82aff6a3f0ad4533029392f48502a7e2.exe
"C:\Users\Admin\AppData\Local\Temp\82aff6a3f0ad4533029392f48502a7e2.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\82aff6a3f0ad4533029392f48502a7e2.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\lsass.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\wininit.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
  "C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3044
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\541fafff-a87c-40f5-a3e8-52a31cb354e0.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2044
  - - C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
      C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:448
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\282b7a1a-5c98-4f33-98bb-1289f5ab5eac.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2344
      - C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        
        C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:2632
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0cea1de4-e776-45eb-a056-e7c58df6091f.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        
        C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        System policy modification
        
        PID:1952
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5954c68b-1dbe-4abe-ad58-b979200cf1ac.vbs"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        
        C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1756
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2fadcb05-d580-4307-8760-d1fbe599c281.vbs"
        11⤵
        
        PID:2040
        
        C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        
        C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bb1c732b-27a7-40cf-906d-3bf4db1574cb.vbs"
        13⤵
        
        PID:528
        
        C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        
        C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1800
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\82697357-d201-4eac-8ac4-8c6b9cfc2f98.vbs"
        15⤵
        
        PID:1864
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1294d68-9786-4b39-9162-5941f3ccf2c0.vbs"
        15⤵
        
        PID:1488
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\aafc7429-587c-48c7-b0b9-ff766ff943c1.vbs"
        13⤵
        
        PID:1732
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\879667ca-eb16-45b4-8cb6-bf873a99f7b5.vbs"
        11⤵
        
        PID:2828
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0ce27db8-1fbc-45d7-90f4-e33718fe82b4.vbs"
        9⤵
        
        PID:484
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\01eb675a-925a-4255-a42c-254f0250dd37.vbs"
        7⤵
        
        PID:2848
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6748c42c-b9de-40e3-81c8-45fe26441dd3.vbs"
        5⤵
        
        PID:1744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\801328d6-d284-47c6-9d67-bf8d71f97df5.vbs"
    3⤵
    PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Users\Public\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Public\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Media Player\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Media Player\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\1a287102-69f6-11ef-b2ff-62cb582c238c\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe

Filesize
1.9MB

MD5
82aff6a3f0ad4533029392f48502a7e2

SHA1
f895f75e4ca2fa64ea2f7fc8026f7d45d6fb7a63

SHA256
40ea09eeb440e55f9020c374046c518009e516ee3efba244fa94fcf753325d61

SHA512
8f12d8f615b260cd390139a82bc8b8ec70bd383f7c0fc17df86c8edc6d1b2a902bb9c4f40209f7d096ff1ed8c1aac12806972ab14e4fe59248d152b7992134e7

Download Submit
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\smss.exe

Filesize
1.9MB

MD5
eabcb57b9df9948f2eef9d9b7f7cb5ae

SHA1
541b6f4538eade449262e1a9a355c3479776b4e2

SHA256
d65f7acac1f2cacb4049d64058edc0639f4484f3b6a7b87ca77f6ed4ebf249b6

SHA512
cd17b0a2bce774dd9c4b1b3bbd7edf8dc704d58297b52f3016fe18941c43a8914316d53c206c2af07dbdc738535239cc12227bc84838f5ad8370911b1bf2270a

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\de-DE\explorer.exe

Filesize
1.9MB

MD5
813556822f0ed671b07ee20cbe4d6593

SHA1
e0f60f491cf6d31d2d8fb1aedb82707176e14aeb

SHA256
1dd318a9d9efb9f413a442112ed035fb704304442a09169dbc011c3e88d4a53c

SHA512
e20de88cf4090d6328bf8b5afaff40aaedd198956144fca1f684141437943d0ddabf9351a017c39492d92f00d43f6c0f4d37824d040498dff9cffecc86573d6c

Download Submit
C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\lsass.exe

Filesize
1.9MB

MD5
fd63d15eedec0ed7d4d2e82aaa8386fd

SHA1
aea40857cbb46dae2c7753db0a7b54ff6e7f22c3

SHA256
971cfef0bd3afd67b3e7e5808ccf19eef49a1a8f629916e200dac00709967501

SHA512
cc8258e0586adfc642418162eb4312a05ed12728b06b5d120210aeb6d439ec75821a5c00432af96f794255dfe46e7f433490be766c0327e445a531d0c479e3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\0cea1de4-e776-45eb-a056-e7c58df6091f.vbs

Filesize
734B

MD5
d265fef818caedd98d4152199ab30a02

SHA1
fe546ad3cc8bc6c19549ef0e8d49353aa3596134

SHA256
e826caf2fb3eaa38a5e9019dbd94ad2519a0d114fd6d4352fe1b38f858527dd5

SHA512
72be01f4dec0fb520b02bade62fe59058837314810654ef452f18ae6f7b850f92b7ae820271e671b02fd7dea9bb91ab5a46cfc56407b2f3baa0912e9c165eb16

Download Submit
C:\Users\Admin\AppData\Local\Temp\282b7a1a-5c98-4f33-98bb-1289f5ab5eac.vbs

Filesize
733B

MD5
862866925a4c267eed237b3814ccb293

SHA1
43f9290b98bac4d5e18ae078d8326477920cff4a

SHA256
a0f9a0e1ff303ceb7d73a510aec52c37b484410c62c3b8459c4f2f727b80c54c

SHA512
2736a480b2f61e15487d03c241473d12d1841c69eb96d2a0b78ca980451f0f575ec09255813a7607c60b14a76a35c459f9271cc7c6d59e674c1342c2d3c2bd50

Download Submit
C:\Users\Admin\AppData\Local\Temp\2fadcb05-d580-4307-8760-d1fbe599c281.vbs

Filesize
734B

MD5
53960c398f5958a5ba83b0cdb4c42336

SHA1
22bda2c3bab13a9b3ab4dce9f22fcba72f98b22e

SHA256
76129cd26afb9cae033532bff763ae2129b57d2b4b4e0b7bf41cb8292c6ad3e6

SHA512
874f9a203277444c43ed68cef9ba30c04e016a4fe3f71c18a85181138d794563558f87cbe424ea14785b60109ef8a026d125412747970e6788a43d791c5c0b98

Download Submit
C:\Users\Admin\AppData\Local\Temp\541fafff-a87c-40f5-a3e8-52a31cb354e0.vbs

Filesize
734B

MD5
76e3751714f03796963a9de66af4eb35

SHA1
190083ec67863e1e703eac4a0e31e24e9362e714

SHA256
95008fe7f5504d79209519a0dfa64916a1ee137b6d505615a95b4c681c1d2939

SHA512
309df53aba28cadfbaab8fee4935de3674ccd28161f9f50c4917dad6866ea5f3eb71f33ee42c1bd56539c2c2b23486e4ab2a1ada6ea7e38fd9364be84ebe6678

Download Submit
C:\Users\Admin\AppData\Local\Temp\5954c68b-1dbe-4abe-ad58-b979200cf1ac.vbs

Filesize
734B

MD5
6fd588b555c80da41c998d8e2bae43bc

SHA1
52f019712f71ccb2d928a19089a33de150c5582f

SHA256
cc67d744cf7e67b852aa9f72552b0a2b337ed1034602843d5339972b00b2b814

SHA512
a722efb85f42c773763882d1c1e50c96c2d443ccbda4ca487001c249d34c861d78494860aa3068391cf2b359b411a6ee568bd291575dfef0803818c1f6b3fe3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\801328d6-d284-47c6-9d67-bf8d71f97df5.vbs

Filesize
510B

MD5
0e795541e6c20af5d068e4533827b3ad

SHA1
83809921c053a631168a36b03604627a8b919739

SHA256
ee6f56eef3a5f786129095f45856d1dbc659748ba9d11a84a040c71810b6d3a5

SHA512
3d148984c8300a80d40f2fd50f8b569965469f55bfa0d257b4836cb421032d3218b3991322ed922b5f4783919fe45e31a1eb9d1df89f2ef67d459d1a570ebc49

Download Submit
C:\Users\Admin\AppData\Local\Temp\82697357-d201-4eac-8ac4-8c6b9cfc2f98.vbs

Filesize
734B

MD5
e51a77664009472fb37fd36325b5d9d3

SHA1
3eb948c3966fa2a073b00216550232f0393f7883

SHA256
8a015522d23d62f65e68781f7b2f5f79b60f8328ff6bb8a3fe1b3a23a8eafeb7

SHA512
a6e81ccbd5f7b7c5c2022582005e9665427fd03083c0876b3c27cc1c34aea9519bfb8e7492f0765d715fc2e5357110873e96ffa6ed8ecdcb4c129637ba7d1f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\bb1c732b-27a7-40cf-906d-3bf4db1574cb.vbs

Filesize
734B

MD5
21afe9e5b9b1366125020d21f5b88de1

SHA1
284e4d6d8af50c17217298c8edaf629981bb32fa

SHA256
3f9dc05e34a9a87bbf798244470ce919d956c8e2d56b5e2ea6200b01b68ca13e

SHA512
fa0ee1f3ba022bb1de8b549143046bb543e791e9bc898e317fdff0370db4c229e71a8d782f2adc2720ba67e3082479cc4762ce2bc22bdd35d419eb594806c654

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c7f39acbfcdb6d2182b4aa0a824883af

SHA1
94608aed0bebb8373aa64b50ac542d7ad3131ead

SHA256
c8a780694804ea747471184a4b98825585e683c5eab15f25fe669b65b33d48a3

SHA512
8e638fb990a83a8a8bbc1c517a43ff45a754e5444baab6aade0b0345953eabfe24568232770d1c527561cf1c34c8c73df5b87e5c88ad219341708b99b39f755f

Download Submit
memory/1484-234-0x0000000000B90000-0x0000000000BE6000-memory.dmp

Filesize
344KB

Download
memory/1756-222-0x0000000000570000-0x0000000000582000-memory.dmp

Filesize
72KB

Download
memory/1756-221-0x00000000012E0000-0x00000000014CA000-memory.dmp

Filesize
1.9MB

Download
memory/1800-246-0x0000000000BA0000-0x0000000000BF6000-memory.dmp

Filesize
344KB

Download
memory/2008-1-0x0000000000BE0000-0x0000000000DCA000-memory.dmp

Filesize
1.9MB

Download
memory/2008-13-0x0000000002320000-0x000000000232C000-memory.dmp

Filesize
48KB

Download
memory/2008-4-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download
memory/2008-3-0x0000000000460000-0x000000000047C000-memory.dmp

Filesize
112KB

Download
memory/2008-2-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download
memory/2008-14-0x00000000023D0000-0x00000000023DA000-memory.dmp

Filesize
40KB

Download
memory/2008-7-0x0000000000B60000-0x0000000000B6A000-memory.dmp

Filesize
40KB

Download
memory/2008-8-0x00000000022B0000-0x0000000002306000-memory.dmp

Filesize
344KB

Download
memory/2008-9-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Filesize
48KB

Download
memory/2008-174-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

Filesize
9.9MB

Download
memory/2008-10-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

Filesize
32KB

Download
memory/2008-16-0x00000000023F0000-0x00000000023F8000-memory.dmp

Filesize
32KB

Download
memory/2008-18-0x0000000002410000-0x000000000241C000-memory.dmp

Filesize
48KB

Download
memory/2008-0-0x000007FEF5393000-0x000007FEF5394000-memory.dmp

Filesize
4KB

Download
memory/2008-12-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

Filesize
72KB

Download
memory/2008-5-0x0000000000B30000-0x0000000000B40000-memory.dmp

Filesize
64KB

Download
memory/2008-6-0x0000000000B40000-0x0000000000B56000-memory.dmp

Filesize
88KB

Download
memory/2008-17-0x0000000002400000-0x000000000240C000-memory.dmp

Filesize
48KB

Download
memory/2008-15-0x00000000023E0000-0x00000000023EE000-memory.dmp

Filesize
56KB

Download
memory/2360-161-0x00000000027D0000-0x00000000027D8000-memory.dmp

Filesize
32KB

Download
memory/2360-159-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2632-198-0x0000000000B50000-0x0000000000B62000-memory.dmp

Filesize
72KB

Download
memory/2632-197-0x00000000011D0000-0x00000000013BA000-memory.dmp

Filesize
1.9MB

Download
memory/3044-175-0x0000000000EC0000-0x0000000000ED2000-memory.dmp

Filesize
72KB

Download
memory/3044-158-0x0000000000EF0000-0x00000000010DA000-memory.dmp

Filesize
1.9MB

Download