colibri | 1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2022, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37aa26e9208b0930fb1068d718d2e32e.exe
Size 4.9MB
Sample221015-j9j37sfdc8
SHA256 1a93d204cd4bf9b77434af18be074c47ad7fcebdd109ecc87f77d6b78a9ff2b3
MD5 37aa26e9208b0930fb1068d718d2e32e
SHA1 89a3c8a1f0288b0cb6797d0e17ddaa7961d65acc
SHA512 5c2645f16f8a0ba54c31128fc5f0f8b7b5e81ce208f42798904d39fd6de08e6f1378f9665e70412f5ba6b575dd90ca90191a8cbcdbf24511337a0ecf422d7fc8
SSDEEP 49152:bl5MTGChZpxtlBBgxchXb/zqP6DUtRgs5q289dAnSz44hnW1XgnYu6fYmPkMSx8E:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

colibri dcrat build1 evasion infostealer loader rat spyware stealer trojan

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php
http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		3900	schtasks.exe
		2160	schtasks.exe
		4600	schtasks.exe
		4136	schtasks.exe
		4020	schtasks.exe
		5496	schtasks.exe
		4660	schtasks.exe
		4040	schtasks.exe
		5980	schtasks.exe
File created	C:\Windows\Prefetch\ReadyBoot\6cb0b6c459d5d3		37aa26e9208b0930fb1068d718d2e32e.exe
		3508	schtasks.exe
		4956	schtasks.exe
		5976	schtasks.exe
		1092	schtasks.exe
		6024	schtasks.exe
File created	C:\Program Files (x86)\Windows Mail\c5b4cb5e9653cc		37aa26e9208b0930fb1068d718d2e32e.exe
		2632	schtasks.exe
		5420	schtasks.exe
		3432	schtasks.exe
		3540	schtasks.exe
		5752	schtasks.exe
		5824	schtasks.exe
		5356	schtasks.exe
		4656	schtasks.exe
		4732	schtasks.exe
		3088	schtasks.exe
		3824	schtasks.exe
File created	C:\Windows\tracing\5b884080fd4f94		37aa26e9208b0930fb1068d718d2e32e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA		37aa26e9208b0930fb1068d718d2e32e.exe
		2428	schtasks.exe
		4688	schtasks.exe
		3620	schtasks.exe
		2328	schtasks.exe
		5468	schtasks.exe
		5388	schtasks.exe
		2820	schtasks.exe
		5444	schtasks.exe
		5704	schtasks.exe
		4256	schtasks.exe
		224	schtasks.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6203df4a6bafc7		37aa26e9208b0930fb1068d718d2e32e.exe
		5436	schtasks.exe
		2340	schtasks.exe
		5016	schtasks.exe
		4632	schtasks.exe
		5452	schtasks.exe
		2464	schtasks.exe
		4680	schtasks.exe
		2116	schtasks.exe
		2700	schtasks.exe
		5320	schtasks.exe
		1312	schtasks.exe
		3320	schtasks.exe
		5900	schtasks.exe
		4320	schtasks.exe
		620	schtasks.exe
		4560	schtasks.exe
		5020	schtasks.exe
		5404	schtasks.exe
		2060	schtasks.exe
		5344	schtasks.exe
		5304	schtasks.exe
		2228	schtasks.exe
		3752	schtasks.exe

Process spawned unexpected child process 63 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3320	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4956	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4632	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2160	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4320	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4560	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	176	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	224	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1092	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4732	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4360	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4256	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3620	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3540	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4368	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3752	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4656	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5016	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4600	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4020	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4680	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5420	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5436	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5468	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5452	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5404	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5388	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4660	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2340	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5444	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4040	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4136	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5704	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5752	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5900	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5976	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6024	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5980	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2060	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5344	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5496	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5824	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5304	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	528	schtasks.exe	25
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5356	528	schtasks.exe	25

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	37aa26e9208b0930fb1068d718d2e32e.exe

Executes dropped EXE 11 IoCs

pid	Process
4216	tmp8BBA.tmp.exe
3496	tmp8BBA.tmp.exe
5260	37aa26e9208b0930fb1068d718d2e32e.exe
5680	tmpD45C.tmp.exe
5740	tmpD45C.tmp.exe
216	37aa26e9208b0930fb1068d718d2e32e.exe
5264	tmp101D.tmp.exe
3432	tmp101D.tmp.exe
5572	explorer.exe
628	tmp33C2.tmp.exe
4136	tmp33C2.tmp.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	37aa26e9208b0930fb1068d718d2e32e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	37aa26e9208b0930fb1068d718d2e32e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	37aa26e9208b0930fb1068d718d2e32e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	ipinfo.io
51	ipinfo.io

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4216 set thread context of 3496	4216	tmp8BBA.tmp.exe	121
PID 5680 set thread context of 5740	5680	tmpD45C.tmp.exe	161
PID 5264 set thread context of 3432	5264	tmp101D.tmp.exe	214
PID 628 set thread context of 4136	628	tmp33C2.tmp.exe	241

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\en-US\RuntimeBroker.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\sihost.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files\Windows Defender\it-IT\taskhostw.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files\Windows Defender\it-IT\ea9f0e6c9e2dcd	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files\Internet Explorer\en-US\9e8d7a4ca61bd9	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files (x86)\Windows Mail\c5b4cb5e9653cc	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\taskhostw.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files\Internet Explorer\en-US\RuntimeBroker.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCXABD2.tmp	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\sihost.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\66fc9ff0ee96c2	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6203df4a6bafc7	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\RCX99CA.tmp	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\services.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\RCX9C5B.tmp	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files (x86)\Windows Mail\services.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\9e8d7a4ca61bd9	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\1f93f77a7f4778	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe	37aa26e9208b0930fb1068d718d2e32e.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tracing\fontdrvhost.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Windows\Prefetch\ReadyBoot\dwm.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\dwm.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Windows\Prefetch\ReadyBoot\6cb0b6c459d5d3	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Windows\tracing\fontdrvhost.exe	37aa26e9208b0930fb1068d718d2e32e.exe
File created	C:\Windows\tracing\5b884080fd4f94	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\RCX8F85.tmp	37aa26e9208b0930fb1068d718d2e32e.exe
File opened for modification	C:\Windows\tracing\RCX9EFC.tmp	37aa26e9208b0930fb1068d718d2e32e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 63 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4136	schtasks.exe
3824	schtasks.exe
4020	schtasks.exe
2340	schtasks.exe
5444	schtasks.exe
1312	schtasks.exe
2060	schtasks.exe
2160	schtasks.exe
224	schtasks.exe
4256	schtasks.exe
2116	schtasks.exe
3620	schtasks.exe
2632	schtasks.exe
5900	schtasks.exe
3320	schtasks.exe
4600	schtasks.exe
5980	schtasks.exe
5304	schtasks.exe
5976	schtasks.exe
2328	schtasks.exe
4732	schtasks.exe
4656	schtasks.exe
3088	schtasks.exe
3508	schtasks.exe
4360	schtasks.exe
2228	schtasks.exe
3540	schtasks.exe
2428	schtasks.exe
4680	schtasks.exe
5420	schtasks.exe
5752	schtasks.exe
5356	schtasks.exe
5404	schtasks.exe
6024	schtasks.exe
4688	schtasks.exe
4560	schtasks.exe
176	schtasks.exe
2464	schtasks.exe
1092	schtasks.exe
4368	schtasks.exe
3088	schtasks.exe
5468	schtasks.exe
4040	schtasks.exe
5016	schtasks.exe
2700	schtasks.exe
5824	schtasks.exe
5320	schtasks.exe
3432	schtasks.exe
2820	schtasks.exe
620	schtasks.exe
5452	schtasks.exe
4660	schtasks.exe
5496	schtasks.exe
5344	schtasks.exe
4956	schtasks.exe
3900	schtasks.exe
5020	schtasks.exe
5704	schtasks.exe
5388	schtasks.exe
4632	schtasks.exe
4320	schtasks.exe
3752	schtasks.exe
5436	schtasks.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	37aa26e9208b0930fb1068d718d2e32e.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	37aa26e9208b0930fb1068d718d2e32e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	37aa26e9208b0930fb1068d718d2e32e.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
3112	37aa26e9208b0930fb1068d718d2e32e.exe
1768	powershell.exe
1768	powershell.exe
2000	powershell.exe
2000	powershell.exe
4060	powershell.exe
4060	powershell.exe
4312	powershell.exe
4312	powershell.exe
4056	powershell.exe
4056	powershell.exe
5100	powershell.exe
5100	powershell.exe
4612	powershell.exe
4612	powershell.exe
5116	powershell.exe
5116	powershell.exe
4220	powershell.exe
4220	powershell.exe
2744	powershell.exe
2744	powershell.exe
4660	schtasks.exe
4660	schtasks.exe
4540	powershell.exe
4540	powershell.exe
4660	schtasks.exe
4540	powershell.exe
4220	powershell.exe
4312	powershell.exe
5116	powershell.exe
2000	powershell.exe
4060	powershell.exe
2744	powershell.exe
5100	powershell.exe
4056	powershell.exe
4612	powershell.exe
1768	powershell.exe
1768	powershell.exe
5260	37aa26e9208b0930fb1068d718d2e32e.exe
5260	37aa26e9208b0930fb1068d718d2e32e.exe
5260	37aa26e9208b0930fb1068d718d2e32e.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	3112	37aa26e9208b0930fb1068d718d2e32e.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	4660	schtasks.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	5260	37aa26e9208b0930fb1068d718d2e32e.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeDebugPrivilege	5764	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	5856	powershell.exe
Token: SeDebugPrivilege	5912	powershell.exe
Token: SeDebugPrivilege	5944	Conhost.exe
Token: SeDebugPrivilege	6028	powershell.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	6132	powershell.exe
Token: SeDebugPrivilege	5492	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	216	37aa26e9208b0930fb1068d718d2e32e.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	5540	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	6060	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	5572	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5572	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 4216	3112	37aa26e9208b0930fb1068d718d2e32e.exe	119
PID 3112 wrote to memory of 4216	3112	37aa26e9208b0930fb1068d718d2e32e.exe	119
PID 3112 wrote to memory of 4216	3112	37aa26e9208b0930fb1068d718d2e32e.exe	119
PID 4216 wrote to memory of 3496	4216	tmp8BBA.tmp.exe	121
PID 4216 wrote to memory of 3496	4216	tmp8BBA.tmp.exe	121
PID 4216 wrote to memory of 3496	4216	tmp8BBA.tmp.exe	121
PID 4216 wrote to memory of 3496	4216	tmp8BBA.tmp.exe	121
PID 4216 wrote to memory of 3496	4216	tmp8BBA.tmp.exe	121
PID 4216 wrote to memory of 3496	4216	tmp8BBA.tmp.exe	121
PID 4216 wrote to memory of 3496	4216	tmp8BBA.tmp.exe	121
PID 3112 wrote to memory of 4660	3112	37aa26e9208b0930fb1068d718d2e32e.exe	126
PID 3112 wrote to memory of 4660	3112	37aa26e9208b0930fb1068d718d2e32e.exe	126
PID 3112 wrote to memory of 2000	3112	37aa26e9208b0930fb1068d718d2e32e.exe	127
PID 3112 wrote to memory of 2000	3112	37aa26e9208b0930fb1068d718d2e32e.exe	127
PID 3112 wrote to memory of 1768	3112	37aa26e9208b0930fb1068d718d2e32e.exe	129
PID 3112 wrote to memory of 1768	3112	37aa26e9208b0930fb1068d718d2e32e.exe	129
PID 3112 wrote to memory of 5100	3112	37aa26e9208b0930fb1068d718d2e32e.exe	134
PID 3112 wrote to memory of 5100	3112	37aa26e9208b0930fb1068d718d2e32e.exe	134
PID 3112 wrote to memory of 4312	3112	37aa26e9208b0930fb1068d718d2e32e.exe	131
PID 3112 wrote to memory of 4312	3112	37aa26e9208b0930fb1068d718d2e32e.exe	131
PID 3112 wrote to memory of 4056	3112	37aa26e9208b0930fb1068d718d2e32e.exe	132
PID 3112 wrote to memory of 4056	3112	37aa26e9208b0930fb1068d718d2e32e.exe	132
PID 3112 wrote to memory of 4060	3112	37aa26e9208b0930fb1068d718d2e32e.exe	136
PID 3112 wrote to memory of 4060	3112	37aa26e9208b0930fb1068d718d2e32e.exe	136
PID 3112 wrote to memory of 5116	3112	37aa26e9208b0930fb1068d718d2e32e.exe	138
PID 3112 wrote to memory of 5116	3112	37aa26e9208b0930fb1068d718d2e32e.exe	138
PID 3112 wrote to memory of 4612	3112	37aa26e9208b0930fb1068d718d2e32e.exe	139
PID 3112 wrote to memory of 4612	3112	37aa26e9208b0930fb1068d718d2e32e.exe	139
PID 3112 wrote to memory of 2744	3112	37aa26e9208b0930fb1068d718d2e32e.exe	140
PID 3112 wrote to memory of 2744	3112	37aa26e9208b0930fb1068d718d2e32e.exe	140
PID 3112 wrote to memory of 4220	3112	37aa26e9208b0930fb1068d718d2e32e.exe	143
PID 3112 wrote to memory of 4220	3112	37aa26e9208b0930fb1068d718d2e32e.exe	143
PID 3112 wrote to memory of 4540	3112	37aa26e9208b0930fb1068d718d2e32e.exe	147
PID 3112 wrote to memory of 4540	3112	37aa26e9208b0930fb1068d718d2e32e.exe	147
PID 3112 wrote to memory of 5260	3112	37aa26e9208b0930fb1068d718d2e32e.exe	152
PID 3112 wrote to memory of 5260	3112	37aa26e9208b0930fb1068d718d2e32e.exe	152
PID 5260 wrote to memory of 5680	5260	37aa26e9208b0930fb1068d718d2e32e.exe	159
PID 5260 wrote to memory of 5680	5260	37aa26e9208b0930fb1068d718d2e32e.exe	159
PID 5260 wrote to memory of 5680	5260	37aa26e9208b0930fb1068d718d2e32e.exe	159
PID 5680 wrote to memory of 5740	5680	tmpD45C.tmp.exe	161
PID 5680 wrote to memory of 5740	5680	tmpD45C.tmp.exe	161
PID 5680 wrote to memory of 5740	5680	tmpD45C.tmp.exe	161
PID 5680 wrote to memory of 5740	5680	tmpD45C.tmp.exe	161
PID 5680 wrote to memory of 5740	5680	tmpD45C.tmp.exe	161
PID 5680 wrote to memory of 5740	5680	tmpD45C.tmp.exe	161
PID 5680 wrote to memory of 5740	5680	tmpD45C.tmp.exe	161
PID 5260 wrote to memory of 5764	5260	37aa26e9208b0930fb1068d718d2e32e.exe	162
PID 5260 wrote to memory of 5764	5260	37aa26e9208b0930fb1068d718d2e32e.exe	162
PID 5260 wrote to memory of 5788	5260	37aa26e9208b0930fb1068d718d2e32e.exe	188
PID 5260 wrote to memory of 5788	5260	37aa26e9208b0930fb1068d718d2e32e.exe	188
PID 5260 wrote to memory of 5828	5260	37aa26e9208b0930fb1068d718d2e32e.exe	163
PID 5260 wrote to memory of 5828	5260	37aa26e9208b0930fb1068d718d2e32e.exe	163
PID 5260 wrote to memory of 5856	5260	37aa26e9208b0930fb1068d718d2e32e.exe	185
PID 5260 wrote to memory of 5856	5260	37aa26e9208b0930fb1068d718d2e32e.exe	185
PID 5260 wrote to memory of 5876	5260	37aa26e9208b0930fb1068d718d2e32e.exe	183
PID 5260 wrote to memory of 5876	5260	37aa26e9208b0930fb1068d718d2e32e.exe	183
PID 5260 wrote to memory of 5912	5260	37aa26e9208b0930fb1068d718d2e32e.exe	165
PID 5260 wrote to memory of 5912	5260	37aa26e9208b0930fb1068d718d2e32e.exe	165
PID 5260 wrote to memory of 5944	5260	37aa26e9208b0930fb1068d718d2e32e.exe	218
PID 5260 wrote to memory of 5944	5260	37aa26e9208b0930fb1068d718d2e32e.exe	218
PID 5260 wrote to memory of 6028	5260	37aa26e9208b0930fb1068d718d2e32e.exe	168
PID 5260 wrote to memory of 6028	5260	37aa26e9208b0930fb1068d718d2e32e.exe	168
PID 5260 wrote to memory of 6092	5260	37aa26e9208b0930fb1068d718d2e32e.exe	180
PID 5260 wrote to memory of 6092	5260	37aa26e9208b0930fb1068d718d2e32e.exe	180

System policy modification 1 TTPs 12 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	37aa26e9208b0930fb1068d718d2e32e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	explorer.exe

C:\Users\Admin\AppData\Local\Temp\37aa26e9208b0930fb1068d718d2e32e.exe
"C:\Users\Admin\AppData\Local\Temp\37aa26e9208b0930fb1068d718d2e32e.exe"
1⤵
- DcRat
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3112
- C:\Users\Admin\AppData\Local\Temp\tmp8BBA.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp8BBA.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\tmp8BBA.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp8BBA.tmp.exe"
    3⤵
    - Executes dropped EXE
    PID:3496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
  2⤵
  PID:4660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
  2⤵
  PID:5116
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Users\Admin\AppData\Local\Temp\37aa26e9208b0930fb1068d718d2e32e.exe
  "C:\Users\Admin\AppData\Local\Temp\37aa26e9208b0930fb1068d718d2e32e.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5260
- - C:\Users\Admin\AppData\Local\Temp\tmpD45C.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpD45C.tmp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\tmpD45C.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpD45C.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:5740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5912
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
    3⤵
    PID:5944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sGBfOUR3su.bat"
    3⤵
    PID:5544
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\37aa26e9208b0930fb1068d718d2e32e.exe
      "C:\Users\Admin\AppData\Local\Temp\37aa26e9208b0930fb1068d718d2e32e.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Checks computer location settings
      Checks whether UAC is enabled
      Drops file in Program Files directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      System policy modification
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\tmp101D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp101D.tmp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\tmp101D.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp101D.tmp.exe"
        6⤵
        Executes dropped EXE
        
        PID:3432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6060
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868
    - - C:\odt\explorer.exe
        
        "C:\odt\explorer.exe"
        5⤵
        UAC bypass
        Executes dropped EXE
        Checks computer location settings
        Checks whether UAC is enabled
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        System policy modification
        
        PID:5572
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b3b97a7f-381d-4835-aa1d-69ee0270f627.vbs"
        6⤵
        
        PID:5872
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\86ac4136-bc1b-4f56-9d5f-de816af0b5ec.vbs"
        6⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\tmp33C2.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp33C2.tmp.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:628
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Windows\Prefetch\ReadyBoot\dwm.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Windows\Prefetch\ReadyBoot\dwm.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\odt\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\odt\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Application Data\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Application Data\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Mail\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\sihost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\tracing\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\tracing\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\tracing\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\odt\Idle.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Admin\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\lsass.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Defender\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\it-IT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\it-IT\taskhostw.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4136

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files\Internet Explorer\en-US\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:6024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Internet Explorer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\odt\Registry.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default User\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Templates\backgroundTaskHost.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Default\Templates\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Templates\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5356

C:\Users\Admin\AppData\Local\Temp\tmp33C2.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp33C2.tmp.exe"
1⤵
- Executes dropped EXE
PID:4136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37aa26e9208b0930fb1068d718d2e32e.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\37aa26e9208b0930fb1068d718d2e32e.exe.log
Size 1KB
SHA256 eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a
MD5 bbb951a34b516b66451218a3ec3b0ae1
SHA1 7393835a2476ae655916e0a9687eeaba3ee876e9
SHA512 63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download