dcrat | 58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Size 1.1MB
Sample260910-x5dyaaxvez
SHA256 58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c
MD5 2f3b10b0ac0182f5a60fed385dd88326
SHA1 3c07ed080f0cd92d9452e14536896064491aed76
SHA512 0411ecf2b498760bc4158079816faeec7117bc7dec1b38772641802d48c10682f1466cd3d0bb44e6324b295fe76ec3f45c8a0e7d23f2ef6fe8bd4651652968ff
SSDEEP 24576:HhNn3o3a0KaMVCcOozk9H+pOQUc4+F6Ly++cUVF1ouhK0XfC:HhJokBVCcHzYH+pOQUxRLy+vUr1bN
TLSH
T1E8459C3D9D742FD5E132F6740A65E091F6D082FAB300CB561FE68A485279735A2EF02E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution dcrat infostealer persistence rat trojan

Malware Config

Signatures

Family: DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/4452-11-0x0000000000400000-0x0000000000528000-memory.dmp	dcrat
behavioral1/memory/4452-11-0x0000000000400000-0x0000000000528000-memory.dmp	family_dcrat_v2

Process spawned unexpected child process 42 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3768	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3356	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3864	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	860	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4820	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3484	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4628	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3724	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1320	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3136	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1572	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1892	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4976	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4044	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	888	648	schtasks.exe	91
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	648	schtasks.exe	91

UAC bypass 3 TTPs 6 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1956	powershell.exe
4216	powershell.exe
3888	powershell.exe
1396	powershell.exe
1444	powershell.exe
3000	powershell.exe
3944	powershell.exe
2620	powershell.exe
2892	powershell.exe
3312	powershell.exe
4932	powershell.exe
1144	powershell.exe
3660	powershell.exe
640	powershell.exe
5088	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe

Executes dropped EXE 34 IoCs

pid	Process
968	RuntimeBroker.exe
4028	wininit.exe
1496	csrss.exe
764	TextInputHost.exe
2528	fontdrvhost.exe
4988	sihost.exe
3044	SppExtComObj.exe
3648	WUDFHost.exe
2916	RuntimeBroker.exe
3596	WUDFHost.exe
2152	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
3484	csrss.exe
4368	smss.exe
3304	Registry.exe
6032	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
5356	RuntimeBroker.exe
5100	wininit.exe
2392	wininit.exe
720	wininit.exe
5716	wininit.exe
2176	sihost.exe
6004	TextInputHost.exe
5256	csrss.exe
5588	fontdrvhost.exe
2172	csrss.exe
3488	SppExtComObj.exe
1224	WUDFHost.exe
5740	RuntimeBroker.exe
5976	WUDFHost.exe
3804	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
2824	Registry.exe
5496	smss.exe
5156	csrss.exe
5944	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/4452-17-0x0000000004BA0000-0x0000000004BB0000-memory.dmp	SmartAssembly
behavioral1/memory/4452-21-0x0000000006310000-0x000000000631A000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 3464 set thread context of 4452	3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	90
PID 968 set thread context of 5356	968	RuntimeBroker.exe	195
PID 4028 set thread context of 5716	4028	wininit.exe	199
PID 4988 set thread context of 2176	4988	sihost.exe	200
PID 764 set thread context of 6004	764	TextInputHost.exe	201
PID 2528 set thread context of 5588	2528	fontdrvhost.exe	203
PID 1496 set thread context of 2172	1496	csrss.exe	204
PID 3044 set thread context of 3488	3044	SppExtComObj.exe	205
PID 3648 set thread context of 1224	3648	WUDFHost.exe	206
PID 2916 set thread context of 5740	2916	RuntimeBroker.exe	207
PID 3596 set thread context of 5976	3596	WUDFHost.exe	210
PID 2152 set thread context of 3804	2152	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	212
PID 3304 set thread context of 2824	3304	Registry.exe	213
PID 4368 set thread context of 5496	4368	smss.exe	214
PID 3484 set thread context of 5156	3484	csrss.exe	215
PID 6032 set thread context of 5944	6032	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	220

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\ee807b11fca82c	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCXE5EA.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXEA04.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXEE1F.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files (x86)\Windows Sidebar\SppExtComObj.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files (x86)\Windows Sidebar\WUDFHost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\csrss.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\480b7989c529f6	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCXDD94.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\WUDFHost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files (x86)\Windows Mail\csrss.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files\Windows Sidebar\RCXE1AF.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCXDD95.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\SppExtComObj.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RCXE3E3.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RCXE3E4.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\WUDFHost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files (x86)\Windows Sidebar\e1ef82546f0b02	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files\Windows Sidebar\csrss.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files\Windows Sidebar\886983d96e3d3e	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files (x86)\Windows Mail\886983d96e3d3e	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files\Uninstall Information\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\RCXE5E9.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files\Uninstall Information\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\WUDFHost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files\Windows Sidebar\RCXE1BF.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files\Windows Sidebar\csrss.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCXEA05.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXEE20.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Program Files (x86)\Windows Sidebar\480b7989c529f6	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\it-IT\RCXDFAA.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\it-IT\sihost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Windows\Web\4K\Wallpaper\69ddcba757bf72	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\ja-JP\RCXD6F6.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Windows\it-IT\sihost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Windows\Web\4K\Wallpaper\smss.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\ja-JP\RCXD6F7.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\Web\4K\Wallpaper\smss.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Windows\apppatch\de-DE\fontdrvhost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Windows\it-IT\66fc9ff0ee96c2	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\apppatch\de-DE\RCXD93B.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\it-IT\RCXDF99.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\Web\4K\Wallpaper\RCXEC09.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\Web\4K\Wallpaper\RCXEC1A.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\apppatch\de-DE\fontdrvhost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Windows\ja-JP\TextInputHost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Windows\ja-JP\22eafd247d37c3	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File created	C:\Windows\apppatch\de-DE\5b884080fd4f94	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\ja-JP\TextInputHost.exe	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
File opened for modification	C:\Windows\apppatch\de-DE\RCXD93A.tmp	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Registry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Registry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RuntimeBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WUDFHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SppExtComObj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SppExtComObj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 42 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3864	schtasks.exe
5096	schtasks.exe
3724	schtasks.exe
1320	schtasks.exe
2344	schtasks.exe
2744	schtasks.exe
888	schtasks.exe
2364	schtasks.exe
3484	schtasks.exe
4428	schtasks.exe
2780	schtasks.exe
1672	schtasks.exe
3768	schtasks.exe
1020	schtasks.exe
1848	schtasks.exe
3136	schtasks.exe
1572	schtasks.exe
3660	schtasks.exe
4160	schtasks.exe
3888	schtasks.exe
1820	schtasks.exe
2008	schtasks.exe
2440	schtasks.exe
3356	schtasks.exe
2264	schtasks.exe
860	schtasks.exe
2888	schtasks.exe
4044	schtasks.exe
1360	schtasks.exe
2924	schtasks.exe
2892	schtasks.exe
3188	schtasks.exe
2144	schtasks.exe
1836	schtasks.exe
4628	schtasks.exe
4468	schtasks.exe
1892	schtasks.exe
4976	schtasks.exe
1916	schtasks.exe
4820	schtasks.exe
5076	schtasks.exe
832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
3000	powershell.exe
3000	powershell.exe
1144	powershell.exe
1144	powershell.exe
3312	powershell.exe
3312	powershell.exe
3888	powershell.exe
3888	powershell.exe
640	powershell.exe
640	powershell.exe
4216	powershell.exe
4216	powershell.exe
3944	powershell.exe
3944	powershell.exe
5088	powershell.exe
5088	powershell.exe
4932	powershell.exe
4932	powershell.exe
3660	powershell.exe
3660	powershell.exe
2620	powershell.exe
2620	powershell.exe
2892	powershell.exe
2892	powershell.exe
1396	powershell.exe
1396	powershell.exe
1444	powershell.exe
1444	powershell.exe
1144	powershell.exe
3660	powershell.exe
4216	powershell.exe
640	powershell.exe
3312	powershell.exe
3000	powershell.exe
3888	powershell.exe
5088	powershell.exe
4932	powershell.exe
1396	powershell.exe
3944	powershell.exe
2620	powershell.exe
1444	powershell.exe
2892	powershell.exe
5356	RuntimeBroker.exe
5356	RuntimeBroker.exe
4028	wininit.exe
4028	wininit.exe
4028	wininit.exe
4028	wininit.exe
4028	wininit.exe
4028	wininit.exe
1496	csrss.exe
1496	csrss.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Token: SeDebugPrivilege	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	640	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	3660	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	1396	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	5356	RuntimeBroker.exe
Token: SeDebugPrivilege	4028	wininit.exe
Token: SeDebugPrivilege	5716	wininit.exe
Token: SeDebugPrivilege	6004	TextInputHost.exe
Token: SeDebugPrivilege	1496	csrss.exe
Token: SeDebugPrivilege	2176	sihost.exe
Token: SeDebugPrivilege	5588	fontdrvhost.exe
Token: SeDebugPrivilege	2172	csrss.exe
Token: SeDebugPrivilege	3488	SppExtComObj.exe
Token: SeDebugPrivilege	1224	WUDFHost.exe
Token: SeDebugPrivilege	5740	RuntimeBroker.exe
Token: SeDebugPrivilege	5976	WUDFHost.exe
Token: SeDebugPrivilege	3804	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Token: SeDebugPrivilege	2824	Registry.exe
Token: SeDebugPrivilege	5496	smss.exe
Token: SeDebugPrivilege	5156	csrss.exe
Token: SeDebugPrivilege	5944	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2936	3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	89
PID 3464 wrote to memory of 4452	3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	90
PID 3464 wrote to memory of 4452	3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	90
PID 3464 wrote to memory of 4452	3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	90
PID 3464 wrote to memory of 4452	3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	90
PID 3464 wrote to memory of 4452	3464	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	90
PID 4452 wrote to memory of 3944	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	164
PID 4452 wrote to memory of 3660	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	165
PID 4452 wrote to memory of 1956	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	166
PID 4452 wrote to memory of 2620	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	167
PID 4452 wrote to memory of 4216	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	168
PID 4452 wrote to memory of 640	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	169
PID 4452 wrote to memory of 2892	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	170
PID 4452 wrote to memory of 1396	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	171
PID 4452 wrote to memory of 3312	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	172
PID 4452 wrote to memory of 1444	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	173
PID 4452 wrote to memory of 5088	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	174
PID 4452 wrote to memory of 4932	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	175
PID 4452 wrote to memory of 3888	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	176
PID 4452 wrote to memory of 3000	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	177
PID 4452 wrote to memory of 1144	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	178
PID 4452 wrote to memory of 6032	4452	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe	194
PID 968 wrote to memory of 5356	968	RuntimeBroker.exe	195
PID 968 wrote to memory of 5356	968	RuntimeBroker.exe	195
PID 968 wrote to memory of 5356	968	RuntimeBroker.exe	195
PID 968 wrote to memory of 5356	968	RuntimeBroker.exe	195
PID 968 wrote to memory of 5356	968	RuntimeBroker.exe	195
PID 4028 wrote to memory of 5100	4028	wininit.exe	196
PID 4028 wrote to memory of 2392	4028	wininit.exe	197
PID 4028 wrote to memory of 720	4028	wininit.exe	198
PID 4028 wrote to memory of 5716	4028	wininit.exe	199
PID 4028 wrote to memory of 5716	4028	wininit.exe	199
PID 4028 wrote to memory of 5716	4028	wininit.exe	199
PID 4028 wrote to memory of 5716	4028	wininit.exe	199
PID 4028 wrote to memory of 5716	4028	wininit.exe	199
PID 4988 wrote to memory of 2176	4988	sihost.exe	200
PID 4988 wrote to memory of 2176	4988	sihost.exe	200
PID 4988 wrote to memory of 2176	4988	sihost.exe	200
PID 4988 wrote to memory of 2176	4988	sihost.exe	200
PID 4988 wrote to memory of 2176	4988	sihost.exe	200
PID 764 wrote to memory of 6004	764	TextInputHost.exe	201
PID 764 wrote to memory of 6004	764	TextInputHost.exe	201
PID 764 wrote to memory of 6004	764	TextInputHost.exe	201
PID 764 wrote to memory of 6004	764	TextInputHost.exe	201
PID 764 wrote to memory of 6004	764	TextInputHost.exe	201
PID 2528 wrote to memory of 5588	2528	fontdrvhost.exe	203
PID 1496 wrote to memory of 5256	1496	csrss.exe	202
PID 2528 wrote to memory of 5588	2528	fontdrvhost.exe	203
PID 2528 wrote to memory of 5588	2528	fontdrvhost.exe	203
PID 2528 wrote to memory of 5588	2528	fontdrvhost.exe	203
PID 2528 wrote to memory of 5588	2528	fontdrvhost.exe	203
PID 1496 wrote to memory of 2172	1496	csrss.exe	204
PID 1496 wrote to memory of 2172	1496	csrss.exe	204
PID 1496 wrote to memory of 2172	1496	csrss.exe	204
PID 1496 wrote to memory of 2172	1496	csrss.exe	204
PID 1496 wrote to memory of 2172	1496	csrss.exe	204
PID 3044 wrote to memory of 3488	3044	SppExtComObj.exe	205
PID 3044 wrote to memory of 3488	3044	SppExtComObj.exe	205
PID 3044 wrote to memory of 3488	3044	SppExtComObj.exe	205
PID 3044 wrote to memory of 3488	3044	SppExtComObj.exe	205
PID 3044 wrote to memory of 3488	3044	SppExtComObj.exe	205
PID 3648 wrote to memory of 1224	3648	WUDFHost.exe	206
PID 3648 wrote to memory of 1224	3648	WUDFHost.exe	206
PID 3648 wrote to memory of 1224	3648	WUDFHost.exe	206

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RuntimeBroker.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RuntimeBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
"C:\Users\Admin\AppData\Local\Temp\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
  "{path}"
  2⤵
  PID:2936
- C:\Users\Admin\AppData\Local\Temp\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
  "{path}"
  2⤵
  - UAC bypass
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4452
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ja-JP\TextInputHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:1956
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\apppatch\de-DE\fontdrvhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2620
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\SppExtComObj.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\it-IT\sihost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\WUDFHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\WUDFHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Desktop\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Web\4K\Wallpaper\smss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\Registry.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- - C:\Users\Admin\AppData\Local\Temp\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
    "C:\Users\Admin\AppData\Local\Temp\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
      "{path}"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\ja-JP\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Windows\ja-JP\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5096

C:\Recovery\WindowsRE\RuntimeBroker.exe
"C:\Recovery\WindowsRE\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:968
- C:\Recovery\WindowsRE\RuntimeBroker.exe
  "{path}"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:5356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\apppatch\de-DE\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\apppatch\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Windows\apppatch\de-DE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\Windows\it-IT\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\it-IT\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Windows\it-IT\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Sidebar\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Sidebar\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Sidebar\Gadgets\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Sidebar\Gadgets\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3136

C:\Recovery\WindowsRE\wininit.exe
"C:\Recovery\WindowsRE\wininit.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Recovery\WindowsRE\wininit.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Recovery\WindowsRE\wininit.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Recovery\WindowsRE\wininit.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Recovery\WindowsRE\wininit.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Sidebar\WUDFHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WUDFHostW" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\WUDFHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1892

C:\Program Files\Windows Sidebar\csrss.exe
"C:\Program Files\Windows Sidebar\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Program Files\Windows Sidebar\csrss.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  PID:5256
- C:\Program Files\Windows Sidebar\csrss.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2172

C:\Windows\ja-JP\TextInputHost.exe
"C:\Windows\ja-JP\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\ja-JP\TextInputHost.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Desktop\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976

C:\Windows\apppatch\de-DE\fontdrvhost.exe
"C:\Windows\apppatch\de-DE\fontdrvhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\apppatch\de-DE\fontdrvhost.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5588

C:\Windows\it-IT\sihost.exe
"C:\Windows\it-IT\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\it-IT\sihost.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Desktop\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Web\4K\Wallpaper\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Program Files (x86)\Windows Sidebar\SppExtComObj.exe
"C:\Program Files (x86)\Windows Sidebar\SppExtComObj.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Windows Sidebar\SppExtComObj.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\Web\4K\Wallpaper\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Program Files\Windows Sidebar\Gadgets\WUDFHost.exe
"C:\Program Files\Windows Sidebar\Gadgets\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Program Files\Windows Sidebar\Gadgets\WUDFHost.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\Web\4K\Wallpaper\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c5" /sc MINUTE /mo 7 /tr "'C:\Program Files\Uninstall Information\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c5" /sc MINUTE /mo 13 /tr "'C:\Program Files\Uninstall Information\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1916

C:\Users\Default\Desktop\RuntimeBroker.exe
"C:\Users\Default\Desktop\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2916
- C:\Users\Default\Desktop\RuntimeBroker.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3188

C:\Program Files (x86)\Windows Sidebar\WUDFHost.exe
"C:\Program Files (x86)\Windows Sidebar\WUDFHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3596
- C:\Program Files (x86)\Windows Sidebar\WUDFHost.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5976

C:\Program Files\Uninstall Information\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
"C:\Program Files\Uninstall Information\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2152
- C:\Program Files\Uninstall Information\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3804

C:\Program Files (x86)\Windows Mail\csrss.exe
"C:\Program Files (x86)\Windows Mail\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3484
- C:\Program Files (x86)\Windows Mail\csrss.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5156

C:\Windows\Web\4K\Wallpaper\smss.exe
"C:\Windows\Web\4K\Wallpaper\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4368
- C:\Windows\Web\4K\Wallpaper\smss.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5496

C:\Recovery\WindowsRE\Registry.exe
"C:\Recovery\WindowsRE\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3304
- C:\Recovery\WindowsRE\Registry.exe
  "{path}"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Recovery\WindowsRE\RuntimeBroker.exe
Size 1.1MB
SHA256 58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c
MD5 2f3b10b0ac0182f5a60fed385dd88326
SHA1 3c07ed080f0cd92d9452e14536896064491aed76
SHA512 0411ecf2b498760bc4158079816faeec7117bc7dec1b38772641802d48c10682f1466cd3d0bb44e6324b295fe76ec3f45c8a0e7d23f2ef6fe8bd4651652968ff
SSDEEP 24576:HhNn3o3a0KaMVCcOozk9H+pOQUc4+F6Ly++cUVF1ouhK0XfC:HhJokBVCcHzYH+pOQUxRLy+vUr1bN
TLSH
T1E8459C3D9D742FD5E132F6740A65E091F6D082FAB300CB561FE68A485279735A2EF02E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\58dc9f98541f0136dfb22b8d493c22e9919d46a31761f8aac70cd7e314515b8c.exe.log
Size 1KB
SHA256 c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553
MD5 17573558c4e714f606f997e5157afaac
SHA1 13e16e9415ceef429aaf124139671ebeca09ed23
SHA512 f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc
TLSH
T1D3219D303222B5D94D022F530C186AC523EF474DBB74EE1C7959231EDD2A4579B221E3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
TLSH
T1A8417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download