525209de288e36bab56d3a19446249ffd067c8757b5d5870daa6a782b9567e74

Analysis

max time kernel
147s
max time network
157s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6cdf89e8d2c2fb9a5db53881f501181d.exe
Size

1.9MB
MD5

6cdf89e8d2c2fb9a5db53881f501181d
SHA1

558eda84922e9824a2554414f5f049658d742575
SHA256

d3f54d4b32b7125991bc4a5543f24c536e16c8ac77eba12aad61256817d7ea97
SHA512

65f11caefff09248fef65676f439dc665fb9a540dc6faf90d7b318859c4f4b7cffe7e74de8f57296420a9e051cc929aecf55c509f6c933f5d53c0af43bf61cfd
SSDEEP

24576:kz4T3bMX0/0ZqSEaa3OVFu8VQTo8Ia29MSVyAXmFPf87ptY60/YYhdbh7JRj:kOMX0/08SVYTcxMXPxthD

Score

10^/10

defense_evasion execution trojan

Malware Config

Signatures

Process spawned unexpected child process 60 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2256	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2756	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3048	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1032	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1272	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2468	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2992	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2792	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	700	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1772	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3060	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1692	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2396	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2748	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2376	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	2284	schtasks.exe	29
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1600	2284	schtasks.exe	29

UAC bypass 3 TTPs 24 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1572	powershell.exe
1276	powershell.exe
2932	powershell.exe
2600	powershell.exe
2216	powershell.exe
608	powershell.exe
2308	powershell.exe
1704	powershell.exe
3024	powershell.exe
2384	powershell.exe
1596	powershell.exe
2380	powershell.exe
2660	powershell.exe
2416	powershell.exe
972	powershell.exe
2728	powershell.exe
1504	powershell.exe
2844	powershell.exe
856	powershell.exe
3064	powershell.exe
2900	powershell.exe
3008	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	6cdf89e8d2c2fb9a5db53881f501181d.exe

Executes dropped EXE 7 IoCs

pid	Process
1980	6cdf89e8d2c2fb9a5db53881f501181d.exe
912	lsass.exe
1532	lsass.exe
1672	lsass.exe
2228	lsass.exe
1956	lsass.exe
580	lsass.exe

Checks whether UAC is enabled 1 TTPs 16 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6cdf89e8d2c2fb9a5db53881f501181d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\6ccacd8608530f	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCX230E.tmp	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\6cdf89e8d2c2fb9a5db53881f501181d.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\24dbde2999530e	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\5940a34987c991	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\8877cb4e16dd56	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\0a1fd5f707cd16	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Idle.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Idle.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCX22DE.tmp	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\6cdf89e8d2c2fb9a5db53881f501181d.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sppsvc.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sppsvc.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\DigitalLocker\en-US\csrss.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Windows\DigitalLocker\en-US\886983d96e3d3e	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCX259E.tmp	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Windows\PCHEALTH\ERRORREP\Idle.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Windows\PCHEALTH\ERRORREP\6ccacd8608530f	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Windows\AppPatch\es-ES\lsass.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\RCX25BE.tmp	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Windows\DigitalLocker\en-US\csrss.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File created	C:\Windows\AppPatch\es-ES\6203df4a6bafc7	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Windows\PCHEALTH\ERRORREP\Idle.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe
File opened for modification	C:\Windows\AppPatch\es-ES\lsass.exe	6cdf89e8d2c2fb9a5db53881f501181d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 60 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1272	schtasks.exe
1056	schtasks.exe
2848	schtasks.exe
2852	schtasks.exe
2076	schtasks.exe
2440	schtasks.exe
2444	schtasks.exe
2404	schtasks.exe
1184	schtasks.exe
2256	schtasks.exe
2992	schtasks.exe
700	schtasks.exe
2856	schtasks.exe
2748	schtasks.exe
1308	schtasks.exe
1188	schtasks.exe
2400	schtasks.exe
1760	schtasks.exe
2800	schtasks.exe
2428	schtasks.exe
1564	schtasks.exe
1692	schtasks.exe
900	schtasks.exe
2396	schtasks.exe
3048	schtasks.exe
2192	schtasks.exe
2392	schtasks.exe
2632	schtasks.exe
820	schtasks.exe
3060	schtasks.exe
2616	schtasks.exe
1876	schtasks.exe
1308	schtasks.exe
1032	schtasks.exe
1792	schtasks.exe
1736	schtasks.exe
2376	schtasks.exe
2760	schtasks.exe
2604	schtasks.exe
2840	schtasks.exe
1768	schtasks.exe
1028	schtasks.exe
2068	schtasks.exe
3020	schtasks.exe
1688	schtasks.exe
3036	schtasks.exe
1772	schtasks.exe
2784	schtasks.exe
2756	schtasks.exe
2792	schtasks.exe
2688	schtasks.exe
1916	schtasks.exe
2644	schtasks.exe
1700	schtasks.exe
2228	schtasks.exe
1600	schtasks.exe
2468	schtasks.exe
2888	schtasks.exe
1576	schtasks.exe
1288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2304	6cdf89e8d2c2fb9a5db53881f501181d.exe
3064	powershell.exe
2416	powershell.exe
856	powershell.exe
972	powershell.exe
1980	6cdf89e8d2c2fb9a5db53881f501181d.exe
1980	6cdf89e8d2c2fb9a5db53881f501181d.exe
1980	6cdf89e8d2c2fb9a5db53881f501181d.exe
1980	6cdf89e8d2c2fb9a5db53881f501181d.exe
1980	6cdf89e8d2c2fb9a5db53881f501181d.exe
1980	6cdf89e8d2c2fb9a5db53881f501181d.exe
1980	6cdf89e8d2c2fb9a5db53881f501181d.exe
2844	powershell.exe
3008	powershell.exe
2728	powershell.exe
608	powershell.exe
1596	powershell.exe
2384	powershell.exe
1572	powershell.exe
1504	powershell.exe
1276	powershell.exe
2660	powershell.exe
3024	powershell.exe
2308	powershell.exe
1704	powershell.exe
2380	powershell.exe
2932	powershell.exe
2600	powershell.exe
2900	powershell.exe
2216	powershell.exe
912	lsass.exe
1532	lsass.exe
1672	lsass.exe
2228	lsass.exe
1956	lsass.exe
580	lsass.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	856	powershell.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe
Token: SeDebugPrivilege	2844	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	608	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	1704	powershell.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	912	lsass.exe
Token: SeDebugPrivilege	1532	lsass.exe
Token: SeDebugPrivilege	1672	lsass.exe
Token: SeDebugPrivilege	2228	lsass.exe
Token: SeDebugPrivilege	1956	lsass.exe
Token: SeDebugPrivilege	580	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3064	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	39
PID 2304 wrote to memory of 3064	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	39
PID 2304 wrote to memory of 3064	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	39
PID 2304 wrote to memory of 856	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	40
PID 2304 wrote to memory of 856	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	40
PID 2304 wrote to memory of 856	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	40
PID 2304 wrote to memory of 972	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	41
PID 2304 wrote to memory of 972	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	41
PID 2304 wrote to memory of 972	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	41
PID 2304 wrote to memory of 2416	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	42
PID 2304 wrote to memory of 2416	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	42
PID 2304 wrote to memory of 2416	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	42
PID 2304 wrote to memory of 1980	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	47
PID 2304 wrote to memory of 1980	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	47
PID 2304 wrote to memory of 1980	2304	6cdf89e8d2c2fb9a5db53881f501181d.exe	47
PID 1980 wrote to memory of 608	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	100
PID 1980 wrote to memory of 608	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	100
PID 1980 wrote to memory of 608	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	100
PID 1980 wrote to memory of 1504	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	101
PID 1980 wrote to memory of 1504	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	101
PID 1980 wrote to memory of 1504	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	101
PID 1980 wrote to memory of 1276	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	103
PID 1980 wrote to memory of 1276	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	103
PID 1980 wrote to memory of 1276	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	103
PID 1980 wrote to memory of 2660	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	104
PID 1980 wrote to memory of 2660	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	104
PID 1980 wrote to memory of 2660	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	104
PID 1980 wrote to memory of 2380	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	105
PID 1980 wrote to memory of 2380	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	105
PID 1980 wrote to memory of 2380	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	105
PID 1980 wrote to memory of 1572	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	106
PID 1980 wrote to memory of 1572	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	106
PID 1980 wrote to memory of 1572	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	106
PID 1980 wrote to memory of 2216	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	107
PID 1980 wrote to memory of 2216	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	107
PID 1980 wrote to memory of 2216	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	107
PID 1980 wrote to memory of 3008	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	108
PID 1980 wrote to memory of 3008	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	108
PID 1980 wrote to memory of 3008	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	108
PID 1980 wrote to memory of 2844	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	109
PID 1980 wrote to memory of 2844	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	109
PID 1980 wrote to memory of 2844	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	109
PID 1980 wrote to memory of 1596	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	113
PID 1980 wrote to memory of 1596	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	113
PID 1980 wrote to memory of 1596	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	113
PID 1980 wrote to memory of 2728	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	114
PID 1980 wrote to memory of 2728	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	114
PID 1980 wrote to memory of 2728	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	114
PID 1980 wrote to memory of 2384	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	115
PID 1980 wrote to memory of 2384	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	115
PID 1980 wrote to memory of 2384	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	115
PID 1980 wrote to memory of 2600	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	116
PID 1980 wrote to memory of 2600	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	116
PID 1980 wrote to memory of 2600	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	116
PID 1980 wrote to memory of 3024	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	119
PID 1980 wrote to memory of 3024	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	119
PID 1980 wrote to memory of 3024	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	119
PID 1980 wrote to memory of 2900	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	128
PID 1980 wrote to memory of 2900	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	128
PID 1980 wrote to memory of 2900	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	128
PID 1980 wrote to memory of 2932	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	129
PID 1980 wrote to memory of 2932	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	129
PID 1980 wrote to memory of 2932	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	129
PID 1980 wrote to memory of 1704	1980	6cdf89e8d2c2fb9a5db53881f501181d.exe	130

System policy modification 1 TTPs 24 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6cdf89e8d2c2fb9a5db53881f501181d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsass.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6cdf89e8d2c2fb9a5db53881f501181d.exe
"C:\Users\Admin\AppData\Local\Temp\6cdf89e8d2c2fb9a5db53881f501181d.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6cdf89e8d2c2fb9a5db53881f501181d.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Idle.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\DigitalLocker\en-US\csrss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\smss.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\6cdf89e8d2c2fb9a5db53881f501181d.exe
  "C:\Users\Admin\AppData\Local\Temp\6cdf89e8d2c2fb9a5db53881f501181d.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6cdf89e8d2c2fb9a5db53881f501181d.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PCHEALTH\ERRORREP\Idle.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\6cdf89e8d2c2fb9a5db53881f501181d.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\6cdf89e8d2c2fb9a5db53881f501181d.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\AppPatch\es-ES\lsass.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\dllhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\lsass.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Desktop\taskhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sppsvc.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\System.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\QtqM3qVsgq.bat"
    3⤵
    PID:1808
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:2060
  - - C:\Windows\AppPatch\es-ES\lsass.exe
      "C:\Windows\AppPatch\es-ES\lsass.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:912
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\70c47e66-b5e0-401e-b911-37c6a7497d41.vbs"
        5⤵
        
        PID:2496
      - C:\Windows\AppPatch\es-ES\lsass.exe
        
        C:\Windows\AppPatch\es-ES\lsass.exe
        6⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1532
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\de3f5463-0008-4977-87d7-95b5aaf3de3f.vbs"
        7⤵
        
        PID:1788
        
        C:\Windows\AppPatch\es-ES\lsass.exe
        
        C:\Windows\AppPatch\es-ES\lsass.exe
        8⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1672
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\185ac874-f21a-48de-bbad-23ac1c08b7c1.vbs"
        9⤵
        
        PID:972
        
        C:\Windows\AppPatch\es-ES\lsass.exe
        
        C:\Windows\AppPatch\es-ES\lsass.exe
        10⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:2228
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d7690a3d-d5a2-41ef-bc4c-35163533507b.vbs"
        11⤵
        
        PID:2656
        
        C:\Windows\AppPatch\es-ES\lsass.exe
        
        C:\Windows\AppPatch\es-ES\lsass.exe
        12⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:1956
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\008f5228-c942-45b0-91e0-9df3bc090503.vbs"
        13⤵
        
        PID:1916
        
        C:\Windows\AppPatch\es-ES\lsass.exe
        
        C:\Windows\AppPatch\es-ES\lsass.exe
        14⤵
        UAC bypass
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        System policy modification
        
        PID:580
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d71f7731-5cdf-4d80-af8f-f74067dcffbd.vbs"
        15⤵
        
        PID:2692
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\044d548e-297e-42b1-8a23-c23a932dbda1.vbs"
        15⤵
        
        PID:2440
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\403b22fb-ef6c-4dce-811d-9a1566172734.vbs"
        13⤵
        
        PID:2300
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\062e5b7f-afc1-455c-8d4b-f6e52d7c9a1e.vbs"
        11⤵
        
        PID:1736
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\52425dd1-54e7-4bd9-a397-842f862cc824.vbs"
        9⤵
        
        PID:820
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\49b64e90-5883-4812-915a-6177ee717187.vbs"
        7⤵
        
        PID:1876
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88fc8701-ea65-4638-b1fc-d805b6f7934a.vbs"
        5⤵
        
        PID:264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Windows\DigitalLocker\en-US\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\DigitalLocker\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\DigitalLocker\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\PCHEALTH\ERRORREP\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\PCHEALTH\ERRORREP\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Windows\PCHEALTH\ERRORREP\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 7 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 13 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6cdf89e8d2c2fb9a5db53881f501181d6" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\6cdf89e8d2c2fb9a5db53881f501181d.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6cdf89e8d2c2fb9a5db53881f501181d" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\6cdf89e8d2c2fb9a5db53881f501181d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6cdf89e8d2c2fb9a5db53881f501181d6" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\6cdf89e8d2c2fb9a5db53881f501181d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6cdf89e8d2c2fb9a5db53881f501181d6" /sc MINUTE /mo 8 /tr "'C:\Users\Public\6cdf89e8d2c2fb9a5db53881f501181d.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6cdf89e8d2c2fb9a5db53881f501181d" /sc ONLOGON /tr "'C:\Users\Public\6cdf89e8d2c2fb9a5db53881f501181d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "6cdf89e8d2c2fb9a5db53881f501181d6" /sc MINUTE /mo 13 /tr "'C:\Users\Public\6cdf89e8d2c2fb9a5db53881f501181d.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Windows\AppPatch\es-ES\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\AppPatch\es-ES\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\AppPatch\es-ES\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 9 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Recovery\31f19e42-8726-11ef-be9a-dab21757c799\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Desktop\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Desktop\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Program Files\Reference Assemblies\Microsoft\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\008f5228-c942-45b0-91e0-9df3bc090503.vbs

Filesize
711B

MD5
2aa7346577294544a7100a8258f25b01

SHA1
adfb97b834b5a58639b0089347a5082b9334c82c

SHA256
1064a6c565eb22f92ce82a0e531cce91204db50c4359d281f6901232b85ece3b

SHA512
5756d01255b6d4bdfa20f364ef51e4ea2a2dd00ab6a81f70f51b8a7d82993bd9d4671d9cd423c0ea9952ac77b9812f130eb6388da1f9013da17963f5fba57632

Download Submit
C:\Users\Admin\AppData\Local\Temp\185ac874-f21a-48de-bbad-23ac1c08b7c1.vbs

Filesize
711B

MD5
d59307ee2cf51301cb93b90a42d5e34d

SHA1
2cb44184b629b526a6ffbbc10ce87a9a8b13e39f

SHA256
fe63c98e93525289d7249b773ad9eb82916eb619db013af8fec9feaf7af5d814

SHA512
ac24492f76380bdacd7403396988319113ee0433e8252f1d176b9cc305845fd3eecb6b15f5268c4bbd84a8935cfc1697806452940273c898cb366ec9f16b324c

Download Submit
C:\Users\Admin\AppData\Local\Temp\70c47e66-b5e0-401e-b911-37c6a7497d41.vbs

Filesize
710B

MD5
172846ac1fe79a965e357996f59f8712

SHA1
fcef38d80296861782a0995c8e6684995491ccea

SHA256
40fe18fb949a00c5be9d89b56d5e768fa01b69e0f13afdbf3cc73a368fc019fb

SHA512
7833ada530d634e8a050124997c5d8c3345c26a2f9b349a563902af2e7830812134870333bce1062722b3d9a2fe2ee0fba32e1124097e5036f90ac0a59ef3cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\88fc8701-ea65-4638-b1fc-d805b6f7934a.vbs

Filesize
487B

MD5
dd7de4077542588f4cc08bde06c6056c

SHA1
52d8b91744537c1569e1f31f45672712cd2d25ba

SHA256
9043f954cd478703e0c7ccb1ebb9bfbec587811a2c850b72d006658d0bbb5ee5

SHA512
874d3dea4086bff2cfb55fbf56373bef2a8c343946ff28a0d6224198eabe5a4861b29a6987ac0d596083c05823d2da232876f657361fbf0f7df0d20d6d9bb5d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\QtqM3qVsgq.bat

Filesize
200B

MD5
49f0f5aa07222543d651fb2b2e83eb8d

SHA1
3ecb91f56d040a9e0ade6de63417e821519d930d

SHA256
6969aa5ce4a42525b7c949c3c938191ed3ff4658ae1e3505d83fd2e5f6f0621e

SHA512
7849f156a48315ff7811f8242dbdcf27f4143330c16908a4daa40f7dd3532b83ecf894f45b3e881b69f7f210ba1f291fee148d6eeea7e8371429ac95c17c9a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RCX20BB.tmp

Filesize
1.9MB

MD5
6cdf89e8d2c2fb9a5db53881f501181d

SHA1
558eda84922e9824a2554414f5f049658d742575

SHA256
d3f54d4b32b7125991bc4a5543f24c536e16c8ac77eba12aad61256817d7ea97

SHA512
65f11caefff09248fef65676f439dc665fb9a540dc6faf90d7b318859c4f4b7cffe7e74de8f57296420a9e051cc929aecf55c509f6c933f5d53c0af43bf61cfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\d71f7731-5cdf-4d80-af8f-f74067dcffbd.vbs

Filesize
710B

MD5
20da33f2d19a59427427af8c79a3066e

SHA1
6ffa5821a6d87ddf5f6ea780dee5af71598a6c00

SHA256
7f50d6faceaf5a69be62fb4f3505d3a34a2ea87b526fd4efc73d260d8b947902

SHA512
f25617f94f7a92ea0dcb72b53516359c8652f64df17f82e6b15e3df226e22056a69c2394a77e18562e345d075a42d1cf25415b84356123c3391b19948ee65f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\d7690a3d-d5a2-41ef-bc4c-35163533507b.vbs

Filesize
711B

MD5
ad22e14d69d4cc185366640022c91c46

SHA1
5c94ed14b55e2fd5886ab39a97e19ab8abb7f12c

SHA256
a4ba412d9f225bfe8ef2ae9135e43793878efe226c0107d657333783a5f577d1

SHA512
f30446bb493383651c8171fdc4a45dd37dd305ef730c3e188227436472de16418215b33bbc20f527dff588031ab79af889e9351e3dfada3b28f45a27b3258ba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\de3f5463-0008-4977-87d7-95b5aaf3de3f.vbs

Filesize
711B

MD5
32233f0147a16ace054b67b22e14ef01

SHA1
2da99c88bcf851ade2cde9c573dc563ab5ac578c

SHA256
950592ed2b32e718081857156bfa7ce4f6f036feac0f668e642dcb54e6b9aa1b

SHA512
1c5e3e4996d50625117f4bcb8c515028bcb0935dcfe3ebb15057e5d76fe212b3001ffa6fc1b470f394b46b5501c9ca4bef351f36d1ee8fca8e8aedf844e4c339

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA2DEA.tmp

Filesize
1KB

MD5
72500a84cab2ca3ac0a7218fa01c664e

SHA1
e66217a00b8ee6e339caceefafcc1235ad2245dc

SHA256
de2317077184af459439d2c02858c2274ac2ad9bd2f6f1d3013511dac2d6c82f

SHA512
b8607fd324cb87028f2eb2b9669843c07c61c0fadf1e7ab889f8e18ea64e25faeeff31ffd4c6de953fe5cd9a11d5ffa46b29c218915bf96e12e88558076a621a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
fe10a5327ceb85e90c6031f2d32f727a

SHA1
58ce5f1d65da177a9ae22ca0467e88bcc27dc39a

SHA256
4a2d83fa48dd48d5e2f878f449149ffb9719ae84affb10c3f9123909bb7a98e5

SHA512
a9d01fd99861ea0a82478d444d6eeef94436d86f102211d9a6bae6619feddf71d319e2b65e676585a2abc3abd5e3abea04fe23e48ba6dfc345933caa3d153a3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GFGC94WOBFES6734BU4V.temp

Filesize
7KB

MD5
45a33579454c070ad45da07fef1c086d

SHA1
e4b8ac6ffe2f9ef6e8f10bd9f20bfd9c2fd6b3ae

SHA256
003665ea3743ea18f4f0c5afdd93a283b5fee963c2db882f379765caaa3d46ff

SHA512
b9afd6e65744c92e1fb210c965a4c339faa14527297ba29ab0e3fa83a909cd631ff911149b8bae9936cbeab0f92b3954e3f8f305ed8388521ac9ada0fa8036ff

Download Submit
memory/580-311-0x0000000000BB0000-0x0000000000C06000-memory.dmp

Filesize
344KB

Download
memory/856-87-0x000000001B440000-0x000000001B722000-memory.dmp

Filesize
2.9MB

Download
memory/912-253-0x0000000001180000-0x000000000136A000-memory.dmp

Filesize
1.9MB

Download
memory/1532-264-0x0000000000170000-0x000000000035A000-memory.dmp

Filesize
1.9MB

Download
memory/1956-299-0x0000000001190000-0x000000000137A000-memory.dmp

Filesize
1.9MB

Download
memory/2228-287-0x0000000000050000-0x000000000023A000-memory.dmp

Filesize
1.9MB

Download
memory/2304-10-0x0000000000610000-0x0000000000618000-memory.dmp

Filesize
32KB

Download
memory/2304-9-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/2304-1-0x0000000001340000-0x000000000152A000-memory.dmp

Filesize
1.9MB

Download
memory/2304-89-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Filesize
9.9MB

Download
memory/2304-16-0x0000000000B30000-0x0000000000B38000-memory.dmp

Filesize
32KB

Download
memory/2304-18-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Filesize
48KB

Download
memory/2304-17-0x0000000000B40000-0x0000000000B4C000-memory.dmp

Filesize
48KB

Download
memory/2304-2-0x000007FEF5F00000-0x000007FEF68EC000-memory.dmp

Filesize
9.9MB

Download
memory/2304-3-0x0000000000240000-0x000000000025C000-memory.dmp

Filesize
112KB

Download
memory/2304-15-0x0000000000B20000-0x0000000000B2E000-memory.dmp

Filesize
56KB

Download
memory/2304-13-0x0000000000630000-0x000000000063C000-memory.dmp

Filesize
48KB

Download
memory/2304-14-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Filesize
40KB

Download
memory/2304-0-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

Filesize
4KB

Download
memory/2304-12-0x0000000000620000-0x0000000000632000-memory.dmp

Filesize
72KB

Download
memory/2304-8-0x00000000005B0000-0x0000000000606000-memory.dmp

Filesize
344KB

Download
memory/2304-7-0x00000000005A0000-0x00000000005AA000-memory.dmp

Filesize
40KB

Download
memory/2304-6-0x0000000000300000-0x0000000000316000-memory.dmp

Filesize
88KB

Download
memory/2304-4-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download
memory/2304-5-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2844-181-0x000000001B280000-0x000000001B562000-memory.dmp

Filesize
2.9MB

Download
memory/2844-183-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/3064-88-0x0000000001F90000-0x0000000001F98000-memory.dmp

Filesize
32KB

Download