colibri | 98a6de25f542afaee3621feaf905566e3a5f60c99c5e1c051de2046cd803fb06

Analysis

max time kernel
192s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13f0462af330f984e6bf4f78ca0fd568.exe
Size 4.9MB
Sample221014-xsmdwsecak
SHA256 98a6de25f542afaee3621feaf905566e3a5f60c99c5e1c051de2046cd803fb06
MD5 13f0462af330f984e6bf4f78ca0fd568
SHA1 d4cade4a691d79c8edb40a02036dda11190e4795
SHA512 f04865953da22dd552373cb1a6e027ed2adbe87ad8f3fdbf59145d70fbc6de1310451824f45cc613400b14a4fe333ffe8cb8bdf65407badbcc4a9b76769a8ea8
SSDEEP 49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

colibri dcrat build1 evasion infostealer loader rat trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 45 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1324	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2164	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	208	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3748	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4184	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4192	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	384	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3008	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3608	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2076	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2852	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4572	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	5020	schtasks.exe	81
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3856	5020	schtasks.exe	81

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	13f0462af330f984e6bf4f78ca0fd568.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	13f0462af330f984e6bf4f78ca0fd568.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	13f0462af330f984e6bf4f78ca0fd568.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe

Executes dropped EXE 5 IoCs

pid	Process
4860	tmp44F8.tmp.exe
4144	tmp44F8.tmp.exe
4856	dllhost.exe
1336	tmp11F.tmp.exe
2540	tmp11F.tmp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	13f0462af330f984e6bf4f78ca0fd568.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	dllhost.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	13f0462af330f984e6bf4f78ca0fd568.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	13f0462af330f984e6bf4f78ca0fd568.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fr\smss.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Windows\SysWOW64\fr\69ddcba757bf72	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Windows\SysWOW64\fr\RCX3348.tmp	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Windows\SysWOW64\fr\smss.exe	13f0462af330f984e6bf4f78ca0fd568.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4860 set thread context of 4144	4860	tmp44F8.tmp.exe	98
PID 1336 set thread context of 2540	1336	tmp11F.tmp.exe	167

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Defender\ja-JP\e6c9b481da804f	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Program Files\Windows Defender\ja-JP\fontdrvhost.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\RCXB1A3.tmp	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\RCXBD1D.tmp	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\RCXC32A.tmp	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Program Files\Windows Defender\ja-JP\OfficeClickToRun.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Program Files\Internet Explorer\it-IT\5eb588ee827b5a	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Program Files\Windows Defender\ja-JP\5b884080fd4f94	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfficeClickToRun.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Program Files\Internet Explorer\it-IT\13f0462af330f984e6bf4f78ca0fd568.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\fontdrvhost.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Program Files\Internet Explorer\it-IT\13f0462af330f984e6bf4f78ca0fd568.exe	13f0462af330f984e6bf4f78ca0fd568.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\de-DE\spoolsv.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Windows\Speech_OneCore\lsass.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Windows\Resources\RCX2D1C.tmp	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Windows\de-DE\RCX3098.tmp	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Windows\de-DE\spoolsv.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Windows\Speech_OneCore\RCXC5CB.tmp	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Windows\Speech_OneCore\lsass.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Windows\Resources\sppsvc.exe	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Windows\Resources\0a1fd5f707cd16	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Windows\de-DE\f3b6ecef712a24	13f0462af330f984e6bf4f78ca0fd568.exe
File created	C:\Windows\Speech_OneCore\6203df4a6bafc7	13f0462af330f984e6bf4f78ca0fd568.exe
File opened for modification	C:\Windows\Resources\sppsvc.exe	13f0462af330f984e6bf4f78ca0fd568.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1504	schtasks.exe
1356	schtasks.exe
1596	schtasks.exe
3008	schtasks.exe
2840	schtasks.exe
1080	schtasks.exe
372	schtasks.exe
1744	schtasks.exe
2440	schtasks.exe
1068	schtasks.exe
4468	schtasks.exe
5088	schtasks.exe
4192	schtasks.exe
4504	schtasks.exe
2076	schtasks.exe
1324	schtasks.exe
208	schtasks.exe
1848	schtasks.exe
3748	schtasks.exe
3396	schtasks.exe
3608	schtasks.exe
5076	schtasks.exe
2432	schtasks.exe
1064	schtasks.exe
2852	schtasks.exe
820	schtasks.exe
2476	schtasks.exe
1220	schtasks.exe
4572	schtasks.exe
384	schtasks.exe
5044	schtasks.exe
2080	schtasks.exe
2304	schtasks.exe
4648	schtasks.exe
2164	schtasks.exe
4184	schtasks.exe
3572	schtasks.exe
1368	schtasks.exe
3644	schtasks.exe
1660	schtasks.exe
3856	schtasks.exe
3000	schtasks.exe
4416	schtasks.exe
4540	schtasks.exe
4252	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	13f0462af330f984e6bf4f78ca0fd568.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	dllhost.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
456	13f0462af330f984e6bf4f78ca0fd568.exe
2676	powershell.exe
2676	powershell.exe
4468	powershell.exe
4468	powershell.exe
2948	powershell.exe
2948	powershell.exe
1356	powershell.exe
1356	powershell.exe
4500	powershell.exe
4500	powershell.exe
3984	powershell.exe
3984	powershell.exe
4208	powershell.exe
4208	powershell.exe
2196	powershell.exe
2196	powershell.exe
3876	powershell.exe
3876	powershell.exe
1944	powershell.exe
1944	powershell.exe
4440	powershell.exe
4440	powershell.exe
1288	powershell.exe
1288	powershell.exe
2676	powershell.exe
2676	powershell.exe
3876	powershell.exe
4500	powershell.exe
2948	powershell.exe
1944	powershell.exe
4208	powershell.exe
1356	powershell.exe
2196	powershell.exe
4468	powershell.exe
3984	powershell.exe
4440	powershell.exe
1288	powershell.exe
4856	dllhost.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	456	13f0462af330f984e6bf4f78ca0fd568.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	1356	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe
Token: SeDebugPrivilege	3984	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	4856	dllhost.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 4860	456	13f0462af330f984e6bf4f78ca0fd568.exe	82
PID 456 wrote to memory of 4860	456	13f0462af330f984e6bf4f78ca0fd568.exe	82
PID 456 wrote to memory of 4860	456	13f0462af330f984e6bf4f78ca0fd568.exe	82
PID 4860 wrote to memory of 4144	4860	tmp44F8.tmp.exe	98
PID 4860 wrote to memory of 4144	4860	tmp44F8.tmp.exe	98
PID 4860 wrote to memory of 4144	4860	tmp44F8.tmp.exe	98
PID 4860 wrote to memory of 4144	4860	tmp44F8.tmp.exe	98
PID 4860 wrote to memory of 4144	4860	tmp44F8.tmp.exe	98
PID 4860 wrote to memory of 4144	4860	tmp44F8.tmp.exe	98
PID 4860 wrote to memory of 4144	4860	tmp44F8.tmp.exe	98
PID 456 wrote to memory of 2196	456	13f0462af330f984e6bf4f78ca0fd568.exe	137
PID 456 wrote to memory of 2196	456	13f0462af330f984e6bf4f78ca0fd568.exe	137
PID 456 wrote to memory of 2676	456	13f0462af330f984e6bf4f78ca0fd568.exe	138
PID 456 wrote to memory of 2676	456	13f0462af330f984e6bf4f78ca0fd568.exe	138
PID 456 wrote to memory of 4468	456	13f0462af330f984e6bf4f78ca0fd568.exe	141
PID 456 wrote to memory of 4468	456	13f0462af330f984e6bf4f78ca0fd568.exe	141
PID 456 wrote to memory of 4500	456	13f0462af330f984e6bf4f78ca0fd568.exe	140
PID 456 wrote to memory of 4500	456	13f0462af330f984e6bf4f78ca0fd568.exe	140
PID 456 wrote to memory of 1356	456	13f0462af330f984e6bf4f78ca0fd568.exe	142
PID 456 wrote to memory of 1356	456	13f0462af330f984e6bf4f78ca0fd568.exe	142
PID 456 wrote to memory of 3984	456	13f0462af330f984e6bf4f78ca0fd568.exe	144
PID 456 wrote to memory of 3984	456	13f0462af330f984e6bf4f78ca0fd568.exe	144
PID 456 wrote to memory of 2948	456	13f0462af330f984e6bf4f78ca0fd568.exe	146
PID 456 wrote to memory of 2948	456	13f0462af330f984e6bf4f78ca0fd568.exe	146
PID 456 wrote to memory of 4440	456	13f0462af330f984e6bf4f78ca0fd568.exe	148
PID 456 wrote to memory of 4440	456	13f0462af330f984e6bf4f78ca0fd568.exe	148
PID 456 wrote to memory of 4208	456	13f0462af330f984e6bf4f78ca0fd568.exe	149
PID 456 wrote to memory of 4208	456	13f0462af330f984e6bf4f78ca0fd568.exe	149
PID 456 wrote to memory of 3876	456	13f0462af330f984e6bf4f78ca0fd568.exe	152
PID 456 wrote to memory of 3876	456	13f0462af330f984e6bf4f78ca0fd568.exe	152
PID 456 wrote to memory of 1288	456	13f0462af330f984e6bf4f78ca0fd568.exe	156
PID 456 wrote to memory of 1288	456	13f0462af330f984e6bf4f78ca0fd568.exe	156
PID 456 wrote to memory of 1944	456	13f0462af330f984e6bf4f78ca0fd568.exe	158
PID 456 wrote to memory of 1944	456	13f0462af330f984e6bf4f78ca0fd568.exe	158
PID 456 wrote to memory of 4716	456	13f0462af330f984e6bf4f78ca0fd568.exe	160
PID 456 wrote to memory of 4716	456	13f0462af330f984e6bf4f78ca0fd568.exe	160
PID 4716 wrote to memory of 4392	4716	cmd.exe	163
PID 4716 wrote to memory of 4392	4716	cmd.exe	163
PID 4716 wrote to memory of 4856	4716	cmd.exe	164
PID 4716 wrote to memory of 4856	4716	cmd.exe	164
PID 4856 wrote to memory of 1336	4856	dllhost.exe	165
PID 4856 wrote to memory of 1336	4856	dllhost.exe	165
PID 4856 wrote to memory of 1336	4856	dllhost.exe	165
PID 1336 wrote to memory of 2540	1336	tmp11F.tmp.exe	167
PID 1336 wrote to memory of 2540	1336	tmp11F.tmp.exe	167
PID 1336 wrote to memory of 2540	1336	tmp11F.tmp.exe	167
PID 1336 wrote to memory of 2540	1336	tmp11F.tmp.exe	167
PID 1336 wrote to memory of 2540	1336	tmp11F.tmp.exe	167
PID 1336 wrote to memory of 2540	1336	tmp11F.tmp.exe	167
PID 1336 wrote to memory of 2540	1336	tmp11F.tmp.exe	167
PID 4856 wrote to memory of 1516	4856	dllhost.exe	168
PID 4856 wrote to memory of 1516	4856	dllhost.exe	168
PID 4856 wrote to memory of 2288	4856	dllhost.exe	169
PID 4856 wrote to memory of 2288	4856	dllhost.exe	169

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	13f0462af330f984e6bf4f78ca0fd568.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	13f0462af330f984e6bf4f78ca0fd568.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	13f0462af330f984e6bf4f78ca0fd568.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe

C:\Users\Admin\AppData\Local\Temp\13f0462af330f984e6bf4f78ca0fd568.exe
"C:\Users\Admin\AppData\Local\Temp\13f0462af330f984e6bf4f78ca0fd568.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:456
- C:\Users\Admin\AppData\Local\Temp\tmp44F8.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp44F8.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Users\Admin\AppData\Local\Temp\tmp44F8.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp44F8.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AUfvfl5N9m.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:4392
- - C:\Users\Default User\dllhost.exe
    "C:\Users\Default User\dllhost.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks computer location settings
    - Checks whether UAC is enabled
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\tmp11F.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp11F.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\tmp11F.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp11F.tmp.exe"
        5⤵
        Executes dropped EXE
        
        PID:2540
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7a2d9963-52b9-4c96-ad5f-bd52fe969362.vbs"
      4⤵
      PID:1516
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9e24447e-975b-428e-8145-27905a5f59e0.vbs"
      4⤵
      PID:2288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Microsoft\Settings\Accounts\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Settings\Accounts\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\Settings\Accounts\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\odt\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\odt\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Resources\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Windows\Resources\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Windows\Resources\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Windows\de-DE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\de-DE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\fr\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\SysWOW64\fr\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Windows\SysWOW64\fr\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 13 /tr "'C:\odt\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\odt\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Microsoft\Settings\Accounts\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\Settings\Accounts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft\Settings\Accounts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Defender\ja-JP\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\ja-JP\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "13f0462af330f984e6bf4f78ca0fd5681" /sc MINUTE /mo 10 /tr "'C:\Program Files\Internet Explorer\it-IT\13f0462af330f984e6bf4f78ca0fd568.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "13f0462af330f984e6bf4f78ca0fd568" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\it-IT\13f0462af330f984e6bf4f78ca0fd568.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "13f0462af330f984e6bf4f78ca0fd5681" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\it-IT\13f0462af330f984e6bf4f78ca0fd568.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\ja-JP\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Defender\ja-JP\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Windows\Speech_OneCore\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Speech_OneCore\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\Speech_OneCore\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "13f0462af330f984e6bf4f78ca0fd5681" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Mozilla\updates\13f0462af330f984e6bf4f78ca0fd568.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "13f0462af330f984e6bf4f78ca0fd568" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla\updates\13f0462af330f984e6bf4f78ca0fd568.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "13f0462af330f984e6bf4f78ca0fd5681" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Mozilla\updates\13f0462af330f984e6bf4f78ca0fd568.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...