dcrat | 3112d4e0121280fb873e65e7077ca465e38566e6ebedd9389f3186cd801992a4

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25/08/2022, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2ed94774d28f6a99e563f15777cc015.exe
Size 3.3MB
Sample220825-back3sddbm
SHA256 3112d4e0121280fb873e65e7077ca465e38566e6ebedd9389f3186cd801992a4
MD5 b2ed94774d28f6a99e563f15777cc015
SHA1 b13a811e571ff8e508020e5bcab28e662e24b49d
SHA512 e8406c3354e8d23c125e456a893265322c910f303e0c0456967971067772bc7db7b4052ded82c7cce32e345fba9928f927e50d77fb71e9b8fa3489c1f4126704
SSDEEP 49152:8sAMy1SjCinK5w8bEJ6PUU4v6fbjqeqP/DKHsGXXiuCwKzf64wyeg1qLwNHjACHt:8sD9jqbEQYv6DO1+HskXi7legoYcI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat discovery evasion infostealer persistence rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 10 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\", \"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\lsm.exe\", \"C:\\Users\\Public\\Libraries\\dwm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\", \"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\lsm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\", \"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\lsm.exe\", \"C:\\Users\\Public\\Libraries\\dwm.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dwm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\security\\database\\spoolsv.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\", \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\", \"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\spoolsv.exe\", \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\""	b2ed94774d28f6a99e563f15777cc015.exe

Process spawned unexpected child process 30 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1524	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1796	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1496	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1500	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1040	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	892	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	936	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1284	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1100	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1244	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	1048	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	1048	schtasks.exe	27

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/380-54-0x0000000000130000-0x000000000048E000-memory.dmp	dcrat
behavioral1/files/0x00080000000136da-126.dat	dcrat
behavioral1/files/0x00080000000136da-124.dat	dcrat
behavioral1/memory/2216-127-0x0000000000EF0000-0x000000000124E000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
2216	smss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\Libraries\\dwm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dwm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\lsm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\lsm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\lsm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\dwm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\Idle.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\winlogon.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\smss.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Users\\Public\\Libraries\\dwm.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\security\\database\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\security\\database\\spoolsv.exe\""	b2ed94774d28f6a99e563f15777cc015.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ipinfo.io
8	ipinfo.io

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\6cb0b6c459d5d3	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\RCX6209.tmp	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\f3b6ecef712a24	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\cc11b995f2a76d	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\6ccacd8608530f	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dwm.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\spoolsv.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dwm.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\101b941d020240	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\RCX3143.tmp	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\RCX49A6.tmp	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\spoolsv.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\RCX20FB.tmp	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\RCX2917.tmp	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe	b2ed94774d28f6a99e563f15777cc015.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\security\database\spoolsv.exe	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Windows\security\database\f3b6ecef712a24	b2ed94774d28f6a99e563f15777cc015.exe
File opened for modification	C:\Windows\security\database\RCX18D0.tmp	b2ed94774d28f6a99e563f15777cc015.exe
File created	C:\Windows\security\database\spoolsv.exe	b2ed94774d28f6a99e563f15777cc015.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 30 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2036	schtasks.exe
1524	schtasks.exe
1496	schtasks.exe
684	schtasks.exe
1872	schtasks.exe
548	schtasks.exe
1580	schtasks.exe
1780	schtasks.exe
1688	schtasks.exe
1096	schtasks.exe
1796	schtasks.exe
1672	schtasks.exe
1944	schtasks.exe
1500	schtasks.exe
1584	schtasks.exe
936	schtasks.exe
1284	schtasks.exe
820	schtasks.exe
284	schtasks.exe
1040	schtasks.exe
1100	schtasks.exe
468	schtasks.exe
956	schtasks.exe
2036	schtasks.exe
864	schtasks.exe
1920	schtasks.exe
1812	schtasks.exe
1104	schtasks.exe
892	schtasks.exe
1244	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6970351-2410-11ED-B55D-EA25B6F29539} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
380	b2ed94774d28f6a99e563f15777cc015.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe
2216	smss.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	380	b2ed94774d28f6a99e563f15777cc015.exe
Token: SeDebugPrivilege	2216	smss.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	308	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1732	powershell.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeBackupPrivilege	2304	vssvc.exe
Token: SeRestorePrivilege	2304	vssvc.exe
Token: SeAuditPrivilege	2304	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1248	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2216	smss.exe
1248	iexplore.exe
1248	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 1872	380	b2ed94774d28f6a99e563f15777cc015.exe	58
PID 380 wrote to memory of 1872	380	b2ed94774d28f6a99e563f15777cc015.exe	58
PID 380 wrote to memory of 1872	380	b2ed94774d28f6a99e563f15777cc015.exe	58
PID 380 wrote to memory of 816	380	b2ed94774d28f6a99e563f15777cc015.exe	59
PID 380 wrote to memory of 816	380	b2ed94774d28f6a99e563f15777cc015.exe	59
PID 380 wrote to memory of 816	380	b2ed94774d28f6a99e563f15777cc015.exe	59
PID 380 wrote to memory of 1096	380	b2ed94774d28f6a99e563f15777cc015.exe	67
PID 380 wrote to memory of 1096	380	b2ed94774d28f6a99e563f15777cc015.exe	67
PID 380 wrote to memory of 1096	380	b2ed94774d28f6a99e563f15777cc015.exe	67
PID 380 wrote to memory of 1412	380	b2ed94774d28f6a99e563f15777cc015.exe	65
PID 380 wrote to memory of 1412	380	b2ed94774d28f6a99e563f15777cc015.exe	65
PID 380 wrote to memory of 1412	380	b2ed94774d28f6a99e563f15777cc015.exe	65
PID 380 wrote to memory of 1560	380	b2ed94774d28f6a99e563f15777cc015.exe	64
PID 380 wrote to memory of 1560	380	b2ed94774d28f6a99e563f15777cc015.exe	64
PID 380 wrote to memory of 1560	380	b2ed94774d28f6a99e563f15777cc015.exe	64
PID 380 wrote to memory of 1732	380	b2ed94774d28f6a99e563f15777cc015.exe	62
PID 380 wrote to memory of 1732	380	b2ed94774d28f6a99e563f15777cc015.exe	62
PID 380 wrote to memory of 1732	380	b2ed94774d28f6a99e563f15777cc015.exe	62
PID 380 wrote to memory of 1332	380	b2ed94774d28f6a99e563f15777cc015.exe	68
PID 380 wrote to memory of 1332	380	b2ed94774d28f6a99e563f15777cc015.exe	68
PID 380 wrote to memory of 1332	380	b2ed94774d28f6a99e563f15777cc015.exe	68
PID 380 wrote to memory of 1532	380	b2ed94774d28f6a99e563f15777cc015.exe	71
PID 380 wrote to memory of 1532	380	b2ed94774d28f6a99e563f15777cc015.exe	71
PID 380 wrote to memory of 1532	380	b2ed94774d28f6a99e563f15777cc015.exe	71
PID 380 wrote to memory of 1392	380	b2ed94774d28f6a99e563f15777cc015.exe	72
PID 380 wrote to memory of 1392	380	b2ed94774d28f6a99e563f15777cc015.exe	72
PID 380 wrote to memory of 1392	380	b2ed94774d28f6a99e563f15777cc015.exe	72
PID 380 wrote to memory of 1496	380	b2ed94774d28f6a99e563f15777cc015.exe	73
PID 380 wrote to memory of 1496	380	b2ed94774d28f6a99e563f15777cc015.exe	73
PID 380 wrote to memory of 1496	380	b2ed94774d28f6a99e563f15777cc015.exe	73
PID 380 wrote to memory of 308	380	b2ed94774d28f6a99e563f15777cc015.exe	82
PID 380 wrote to memory of 308	380	b2ed94774d28f6a99e563f15777cc015.exe	82
PID 380 wrote to memory of 308	380	b2ed94774d28f6a99e563f15777cc015.exe	82
PID 380 wrote to memory of 840	380	b2ed94774d28f6a99e563f15777cc015.exe	75
PID 380 wrote to memory of 840	380	b2ed94774d28f6a99e563f15777cc015.exe	75
PID 380 wrote to memory of 840	380	b2ed94774d28f6a99e563f15777cc015.exe	75
PID 380 wrote to memory of 2060	380	b2ed94774d28f6a99e563f15777cc015.exe	80
PID 380 wrote to memory of 2060	380	b2ed94774d28f6a99e563f15777cc015.exe	80
PID 380 wrote to memory of 2060	380	b2ed94774d28f6a99e563f15777cc015.exe	80
PID 2060 wrote to memory of 2184	2060	cmd.exe	79
PID 2060 wrote to memory of 2184	2060	cmd.exe	79
PID 2060 wrote to memory of 2184	2060	cmd.exe	79
PID 2060 wrote to memory of 2216	2060	cmd.exe	85
PID 2060 wrote to memory of 2216	2060	cmd.exe	85
PID 2060 wrote to memory of 2216	2060	cmd.exe	85
PID 2216 wrote to memory of 2684	2216	smss.exe	86
PID 2216 wrote to memory of 2684	2216	smss.exe	86
PID 2216 wrote to memory of 2684	2216	smss.exe	86
PID 2216 wrote to memory of 2704	2216	smss.exe	87
PID 2216 wrote to memory of 2704	2216	smss.exe	87
PID 2216 wrote to memory of 2704	2216	smss.exe	87
PID 2216 wrote to memory of 1248	2216	smss.exe	92
PID 2216 wrote to memory of 1248	2216	smss.exe	92
PID 2216 wrote to memory of 1248	2216	smss.exe	92
PID 1248 wrote to memory of 2604	1248	iexplore.exe	94
PID 1248 wrote to memory of 2604	1248	iexplore.exe	94
PID 1248 wrote to memory of 2604	1248	iexplore.exe	94
PID 1248 wrote to memory of 2604	1248	iexplore.exe	94

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	b2ed94774d28f6a99e563f15777cc015.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	smss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	smss.exe

C:\Users\Admin\AppData\Local\Temp\b2ed94774d28f6a99e563f15777cc015.exe
"C:\Users\Admin\AppData\Local\Temp\b2ed94774d28f6a99e563f15777cc015.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  PID:1872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1412
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\l07988a5Ko.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe
    "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2216
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\64c4f0f4-b536-4251-a165-9c9fee655b09.vbs"
      4⤵
      PID:2684
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\09554b28-2f66-4393-b56f-aa8f172e2c70.vbs"
      4⤵
      PID:2704
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:12193/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\security\database\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\security\database\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\security\database\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 8 /tr "'C:\Recovery\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Recovery\0f610c02-1a7a-11ed-aa03-bd3b28e7cbef\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Libraries\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Public\Libraries\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Libraries\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:956

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
1⤵
PID:2184

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe

Path C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe
Size 3.3MB
SHA256 692357cd605d565d6ed382229465d55bd1c4c319bfb2632a60d840972679a388
MD5 c2060f6ad2183e039923bfdfa50c844e
SHA1 b5f353da99d184d474529b7b6edfe52d2be4d7c1
SHA512 b2d22b436753757e5cba3d88f48d25beb5239c06d8e403de5769624040a5f8a3c310697b19a63644f2a1deb5bbbc26d4cc572c55f9ce58c8b1ff8a376011fb04
SSDEEP 49152:csAMy1SjCinK5w8bEJ6PUU4v6fbjqeqP/DKHsGXXiuCwKzf64wyeg1qLwNHjACHt:csD9jqbEQYv6DO1+HskXi7legoYcI
MD5 SHA1 SHA512 SSDEEP

Submit Download

smss.exe

Path C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\smss.exe
Size 3.3MB
SHA256 692357cd605d565d6ed382229465d55bd1c4c319bfb2632a60d840972679a388
MD5 c2060f6ad2183e039923bfdfa50c844e
SHA1 b5f353da99d184d474529b7b6edfe52d2be4d7c1
SHA512 b2d22b436753757e5cba3d88f48d25beb5239c06d8e403de5769624040a5f8a3c310697b19a63644f2a1deb5bbbc26d4cc572c55f9ce58c8b1ff8a376011fb04
SSDEEP 49152:csAMy1SjCinK5w8bEJ6PUU4v6fbjqeqP/DKHsGXXiuCwKzf64wyeg1qLwNHjACHt:csD9jqbEQYv6DO1+HskXi7legoYcI
MD5 SHA1 SHA512 SSDEEP

Submit Download

09554b28-2f66-4393-b56f-aa8f172e2c70.vbs

Path C:\Users\Admin\AppData\Local\Temp\09554b28-2f66-4393-b56f-aa8f172e2c70.vbs
Size 523B
SHA256 187f07015689e0007035712b590bc43a9a29c2877d9e9a21dda5dd9c558f5df1
MD5 27ea00fb1c2959cf517d7a35636732f0
SHA1 ab0a946014b35757b9891a8c353315c6ea9cbe23
SHA512 da00abee9f2719914f917acd407b18d7d52de29218a5fad60e3b11cd139c696768b814998baf2927f1ae318dba85414823f8bcc5dcf5986a84e5c706bb730d74
MD5 SHA1 SHA512

Submit Download

64c4f0f4-b536-4251-a165-9c9fee655b09.vbs

Path C:\Users\Admin\AppData\Local\Temp\64c4f0f4-b536-4251-a165-9c9fee655b09.vbs
Size 747B
SHA256 c8e19cdafb2eaa4bbf71047f06e4cd6d2acfe2de5789ab21f8dce808c775d22c
MD5 b1c8fe8d28c82d6eba6e7014320fae35
SHA1 1556f97eb07ca0e75f986499d6f2805ed83cbd22
SHA512 63f6b859f854d0c70c3acfa530e6ebfb06ca0f4b3b54c5013f4897e4e27b05832f002bd2a073f81abbd43559ea44381a099128aeae23f0535a18f9e8c2b09675
MD5 SHA1 SHA512

Submit Download

l07988a5Ko.bat

Path C:\Users\Admin\AppData\Local\Temp\l07988a5Ko.bat
Size 236B
SHA256 ae8f5889d5258e6a61f94dd6754b3beb89bf788c94c09be63be1147c1b60a49d
MD5 7bdf79521d2325576be59e0349fbee6e
SHA1 52cea9b8a88b864457083b88b25ff6e2e16b7d9b
SHA512 0fde9b69617f2621223b2f378476a898f66a5071ab250508a84335cf916722a70d17a064fc062b346bcc7fd99aa178f0261547bfe06485499f1f9e83f90c4c28
MD5 SHA1 SHA512

Submit Download