celestialrat | 0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\OEM\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\System.exe\", \"C:\\Recovery\\OEM\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\Download\\PackageFiles\\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\\root\\StartMenuExperienceHost.exe\", \"C:\\Program Files\\Common Files\\System\\sysmon.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\OEM\\OfficeClickToRun.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\OEM\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\System.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\OEM\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\System.exe\", \"C:\\Recovery\\OEM\\fontdrvhost.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\OEM\\OfficeClickToRun.exe\", \"C:\\Users\\Public\\Music\\System.exe\", \"C:\\Recovery\\OEM\\fontdrvhost.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\Download\\PackageFiles\\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\\root\\StartMenuExperienceHost.exe\""	PortproviderBrokerHostSvc.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0"	RunShell.exe

Modifies firewall policy service 3 TTPs 1 IoCs

defense_evasion

Modify Registry

Windows Service

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1"	RunShell.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5688	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5588	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5992	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4616	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	72	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	740	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	740	schtasks.exe	81

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b100-13.dat	family_quasar
behavioral2/memory/4712-33-0x0000025955E50000-0x0000025955FE4000-memory.dmp	family_quasar

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	RunShell.exe

Executes dropped EXE 18 IoCs

pid	Process
4712	PortChecker.exe
2284	ListingPort.exe
5972	RunShell.exe
3048	PortproviderBrokerHostSvc.exe
6120	OfficeClickToRun.exe
5612	System.exe
5096	fontdrvhost.exe
5172	StartMenuExperienceHost.exe
4444	sysmon.exe
2260	System.exe
1420	System.exe
2004	System.exe
3832	System.exe
5416	System.exe
2788	System.exe
2768	System.exe
2052	System.exe
1028	System.exe

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	RunShell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	RunShell.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Public\\Music\\System.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Public\\Music\\System.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\OEM\\fontdrvhost.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Recovery\\OEM\\fontdrvhost.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000\Software\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Microsoft Office\\Updates\\Download\\PackageFiles\\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\\root\\StartMenuExperienceHost.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Program Files\\Microsoft Office\\Updates\\Download\\PackageFiles\\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\\root\\StartMenuExperienceHost.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files\\Common Files\\System\\sysmon.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Recovery\\OEM\\OfficeClickToRun.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files\\Common Files\\System\\sysmon.exe\""	PortproviderBrokerHostSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000\Software\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Recovery\\OEM\\OfficeClickToRun.exe\""	PortproviderBrokerHostSvc.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RunShell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	RunShell.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/files/0x001900000002b101-23.dat	ConfuserEx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC277A976298AA44D89A297F21CE72AC1.TMP	csc.exe
File created	\??\c:\Windows\System32\9siaxz.exe	csc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSCF2DFD48E2BEE4A0380DB17151C2BD133.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\root\StartMenuExperienceHost.exe	PortproviderBrokerHostSvc.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\root\55b276f4edf653	PortproviderBrokerHostSvc.exe
File created	C:\Program Files\Common Files\System\sysmon.exe	PortproviderBrokerHostSvc.exe
File created	C:\Program Files\Common Files\System\121e5b5079f7c0	PortproviderBrokerHostSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
396	PING.EXE
5540	PING.EXE
3700	PING.EXE
2248	PING.EXE
1540	PING.EXE
1020	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5152	timeout.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a.exe
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	PortproviderBrokerHostSvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	System.exe
Key created	\REGISTRY\USER\S-1-5-21-2238466657-712128251-1221219315-1000_Classes\Local Settings	System.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
3700	PING.EXE
2248	PING.EXE
1540	PING.EXE
1020	PING.EXE
396	PING.EXE
5540	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
72	schtasks.exe
4408	schtasks.exe
1164	schtasks.exe
2528	schtasks.exe
5688	schtasks.exe
5992	schtasks.exe
3748	schtasks.exe
1008	schtasks.exe
5588	schtasks.exe
5060	schtasks.exe
1496	schtasks.exe
4696	schtasks.exe
1548	schtasks.exe
1960	schtasks.exe
3036	schtasks.exe
4616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
2284	ListingPort.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
5972	RunShell.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe
3048	PortproviderBrokerHostSvc.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	4712	PortChecker.exe
Token: SeDebugPrivilege	2284	ListingPort.exe
Token: SeDebugPrivilege	2284	ListingPort.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	3048	PortproviderBrokerHostSvc.exe
Token: SeDebugPrivilege	6120	OfficeClickToRun.exe
Token: SeDebugPrivilege	5612	System.exe
Token: SeDebugPrivilege	5096	fontdrvhost.exe
Token: SeDebugPrivilege	5172	StartMenuExperienceHost.exe
Token: SeDebugPrivilege	4444	sysmon.exe
Token: SeDebugPrivilege	2260	System.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	1420	System.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	2004	System.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	3832	System.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	5416	System.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	2788	System.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	2768	System.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	2052	System.exe
Token: SeDebugPrivilege	5972	RunShell.exe
Token: SeDebugPrivilege	1028	System.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 4228	1972	0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a.exe	78
PID 1972 wrote to memory of 4228	1972	0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a.exe	78
PID 1972 wrote to memory of 4712	1972	0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a.exe	79
PID 1972 wrote to memory of 4712	1972	0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a.exe	79
PID 1972 wrote to memory of 2284	1972	0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a.exe	80
PID 1972 wrote to memory of 2284	1972	0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a.exe	80
PID 2284 wrote to memory of 4812	2284	ListingPort.exe	82
PID 2284 wrote to memory of 4812	2284	ListingPort.exe	82
PID 2284 wrote to memory of 4892	2284	ListingPort.exe	84
PID 2284 wrote to memory of 4892	2284	ListingPort.exe	84
PID 4892 wrote to memory of 4356	4892	cmd.exe	86
PID 4892 wrote to memory of 4356	4892	cmd.exe	86
PID 4812 wrote to memory of 2528	4812	cmd.exe	87
PID 4812 wrote to memory of 2528	4812	cmd.exe	87
PID 4892 wrote to memory of 5152	4892	cmd.exe	88
PID 4892 wrote to memory of 5152	4892	cmd.exe	88
PID 4892 wrote to memory of 5972	4892	cmd.exe	89
PID 4892 wrote to memory of 5972	4892	cmd.exe	89
PID 4228 wrote to memory of 2788	4228	WScript.exe	90
PID 4228 wrote to memory of 2788	4228	WScript.exe	90
PID 2788 wrote to memory of 3048	2788	cmd.exe	92
PID 2788 wrote to memory of 3048	2788	cmd.exe	92
PID 3048 wrote to memory of 1672	3048	PortproviderBrokerHostSvc.exe	96
PID 3048 wrote to memory of 1672	3048	PortproviderBrokerHostSvc.exe	96
PID 1672 wrote to memory of 4588	1672	csc.exe	98
PID 1672 wrote to memory of 4588	1672	csc.exe	98
PID 3048 wrote to memory of 6060	3048	PortproviderBrokerHostSvc.exe	99
PID 3048 wrote to memory of 6060	3048	PortproviderBrokerHostSvc.exe	99
PID 6060 wrote to memory of 4068	6060	csc.exe	101
PID 6060 wrote to memory of 4068	6060	csc.exe	101
PID 4340 wrote to memory of 6120	4340	cmd.exe	107
PID 4340 wrote to memory of 6120	4340	cmd.exe	107
PID 2032 wrote to memory of 5612	2032	cmd.exe	113
PID 2032 wrote to memory of 5612	2032	cmd.exe	113
PID 356 wrote to memory of 5096	356	cmd.exe	122
PID 356 wrote to memory of 5096	356	cmd.exe	122
PID 5284 wrote to memory of 5172	5284	cmd.exe	127
PID 5284 wrote to memory of 5172	5284	cmd.exe	127
PID 3048 wrote to memory of 840	3048	PortproviderBrokerHostSvc.exe	128
PID 3048 wrote to memory of 840	3048	PortproviderBrokerHostSvc.exe	128
PID 5208 wrote to memory of 4444	5208	cmd.exe	130
PID 5208 wrote to memory of 4444	5208	cmd.exe	130
PID 840 wrote to memory of 1320	840	cmd.exe	131
PID 840 wrote to memory of 1320	840	cmd.exe	131
PID 840 wrote to memory of 396	840	cmd.exe	132
PID 840 wrote to memory of 396	840	cmd.exe	132
PID 840 wrote to memory of 2260	840	cmd.exe	133
PID 840 wrote to memory of 2260	840	cmd.exe	133
PID 2260 wrote to memory of 3552	2260	System.exe	134
PID 2260 wrote to memory of 3552	2260	System.exe	134
PID 3552 wrote to memory of 5600	3552	cmd.exe	136
PID 3552 wrote to memory of 5600	3552	cmd.exe	136
PID 3552 wrote to memory of 5540	3552	cmd.exe	137
PID 3552 wrote to memory of 5540	3552	cmd.exe	137
PID 3552 wrote to memory of 1420	3552	cmd.exe	138
PID 3552 wrote to memory of 1420	3552	cmd.exe	138
PID 1420 wrote to memory of 5272	1420	System.exe	139
PID 1420 wrote to memory of 5272	1420	System.exe	139
PID 5272 wrote to memory of 5020	5272	cmd.exe	141
PID 5272 wrote to memory of 5020	5272	cmd.exe	141
PID 5272 wrote to memory of 3700	5272	cmd.exe	142
PID 5272 wrote to memory of 3700	5272	cmd.exe	142
PID 5272 wrote to memory of 2004	5272	cmd.exe	143
PID 5272 wrote to memory of 2004	5272	cmd.exe	143

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	RunShell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a.exe
"C:\Users\Admin\AppData\Local\Temp\0e053045a5ab0d4e2a65052bd3aa795d70976b5afa8413b3198f6e30db11409a.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\BrowserRuntimemonitor\XG0nngLOdmA8WK4a3fesfl3nW9DImTmivwepMXJiW1XVwqqxJNtb3KY.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\BrowserRuntimemonitor\JqwTu.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Users\Admin\AppData\Roaming\BrowserRuntimemonitor\PortproviderBrokerHostSvc.exe
      "C:\Users\Admin\AppData\Roaming\BrowserRuntimemonitor/PortproviderBrokerHostSvc.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\voqtq4xk\voqtq4xk.cmdline"
        5⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1672
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB15.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSCF2DFD48E2BEE4A0380DB17151C2BD133.TMP"
        6⤵
        
        PID:4588
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1rnb1411\1rnb1411.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:6060
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB82.tmp" "c:\Windows\System32\CSC277A976298AA44D89A297F21CE72AC1.TMP"
        6⤵
        
        PID:4068
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\eP7pfVemEl.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:840
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1320
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:396
      - C:\Users\Public\Music\System.exe
        
        "C:\Users\Public\Music\System.exe"
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\EZvDZpVxgu.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:5600
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5540
        
        C:\Users\Public\Music\System.exe
        
        "C:\Users\Public\Music\System.exe"
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WzOSwGk9k0.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5272
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:5020
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3700
        
        C:\Users\Public\Music\System.exe
        
        "C:\Users\Public\Music\System.exe"
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\PTUnOlLS5m.bat"
        11⤵
        
        PID:4924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:5008
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1228
        
        C:\Users\Public\Music\System.exe
        
        "C:\Users\Public\Music\System.exe"
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:3832
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DK6554V6Uz.bat"
        13⤵
        
        PID:436
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3704
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2248
        
        C:\Users\Public\Music\System.exe
        
        "C:\Users\Public\Music\System.exe"
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tgniDsG2Ey.bat"
        15⤵
        
        PID:3736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4592
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1540
        
        C:\Users\Public\Music\System.exe
        
        "C:\Users\Public\Music\System.exe"
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2788
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Ot2Axq4KFg.bat"
        17⤵
        
        PID:3160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:224
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1020
        
        C:\Users\Public\Music\System.exe
        
        "C:\Users\Public\Music\System.exe"
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2768
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\RNhQwN31dW.bat"
        19⤵
        
        PID:1288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3592
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        20⤵
        
        PID:1588
        
        C:\Users\Public\Music\System.exe
        
        "C:\Users\Public\Music\System.exe"
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ahsqPXjhJl.bat"
        21⤵
        
        PID:1040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2252
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        22⤵
        
        PID:3716
        
        C:\Users\Public\Music\System.exe
        
        "C:\Users\Public\Music\System.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1028
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VkZKSVlIY6.bat"
        23⤵
        
        PID:4712
- C:\Users\Admin\AppData\Roaming\BrowserRuntimemonitor\PortChecker.exe
  "C:\Users\Admin\AppData\Roaming\BrowserRuntimemonitor\PortChecker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Users\Admin\AppData\Roaming\BrowserRuntimemonitor\ListingPort.exe
  "C:\Users\Admin\AppData\Roaming\BrowserRuntimemonitor\ListingPort.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RunShell" /tr "C:\Users\Admin\Libs\RunShell.exe" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "RunShell" /tr "C:\Users\Admin\Libs\RunShell.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6CF2.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4356
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5152
  - - C:\Users\Admin\Libs\RunShell.exe
      "C:\Users\Admin\Libs\RunShell.exe"
      4⤵
      Modifies Windows Defender DisableAntiSpyware settings
      Modifies firewall policy service
      UAC bypass
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:5972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\OEM\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\OEM\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\OEM\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\OEM\OfficeClickToRun.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Recovery\OEM\OfficeClickToRun.exe
  C:\Recovery\OEM\OfficeClickToRun.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Music\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Music\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Public\Music\System.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Public\Music\System.exe
  C:\Users\Public\Music\System.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\OEM\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\OEM\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\OEM\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Recovery\OEM\fontdrvhost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:356
- C:\Recovery\OEM\fontdrvhost.exe
  C:\Recovery\OEM\fontdrvhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\root\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\root\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\root\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:72

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\root\StartMenuExperienceHost.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\root\StartMenuExperienceHost.exe
  "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\033C208B-F0A5-4D1B-86F9-F299F42DF5DB\root\StartMenuExperienceHost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\System\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\System\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files\Common Files\System\sysmon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Program Files\Common Files\System\sysmon.exe
  "C:\Program Files\Common Files\System\sysmon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry